R3 CI/CD: coverage gate + lint/format (dotnet format + Prettier)

[g9shubh]

Summary

This PR implements my Round 3 (CI/CD) slice: it makes our pipeline prove and enforce quality by adding (1) a per-layer backend code-coverage gate, (2) frontend coverage thresholds, and (3) lint/format checks for both backend and frontend. It pairs with Akash's R3 Security work (cross-tenant 404 test + [Authorize]/non-scoped-entity audit).

No product/runtime behavior changes — this is all CI + test tooling + formatting.

What & Why

1) Backend coverage gate (per layer)

• Added scripts/coverage-gate.sh which:
  • runs the 4 correctness test projects (Domain, Data, Service, Api) with --collect:"XPlat Code Coverage" using our existing coverage.runsettings,
  • uses ReportGenerator (added as a local tool in .config/dotnet-tools.json) to produce a JSON summary per layer,
  • fails CI if any layer's line coverage drops below its floor.
• Floors = measured baseline − 2% (per Round 0 decision — not an aspirational 80%):

Layer	Baseline	Floor
Service	81.1%	79
Domain	77.5%	75
Data	25.6%	23
Api	24.5%	22

• Why Api/Data floors are low: they're mostly un-unit-testable infra (host wiring, middleware, background services, S3/SMTP, Swagger filter, DbSeeder). See point 2.

2) [ExcludeFromCodeCoverage] on infra/wiring

• Annotated non-testable infrastructure classes so coverage reflects logic we actually test, making the Api/Data floors meaningful.
• Files touched (composition root / middleware / background services / storage / seeding / DI extensions):
  • DocAnalytics.Api/Program.cs (assembly-level attribute)
  • Middleware/*, BackgroundServices/*, Swagger/SiteHeaderOperationFilter.cs, Realtime/SignalRPipelineNotifier.cs, Configuration/*, Extensions/*
  • DocAnalytics.Data/DependencyInjection.cs, DataProtectionExtensions.cs, Seeding/DbSeeder.cs
  • DocAnalytics.Service/DependencyInjection.cs, Storage/S3FileStorage.cs, Alerts/SmtpEmailSender.cs
• coverage.runsettings already excludes members marked with this attribute.

3) Frontend coverage thresholds

• Enabled coverage thresholds in docanalytics-web/angular.json under the @angular/build:unit-test builder:
  "coverageThresholds": { "lines": 73, "branches": 68 }
• Baseline was 75.15% lines / 70.11% branches → floors set at −2%.
• The Angular unit-test (Vitest) builder exits with an error when thresholds aren't met, so npx ng test --watch=false in CI now doubles as the frontend coverage gate (no extra CI script needed).
• Also set coverageReporters to text-summary + cobertura for readable CI output.

4) Lint / format checks

• Backend: added dotnet format DocAnalytics.slnx --verify-no-changes to CI (uses root .editorconfig). Ran dotnet format once and committed the result so the verify step is green.
• Frontend: added Prettier scripts to package.json:
  • "format": "prettier --write \"src/**/*.{ts,html,css,json}\""
  • "format:check": "prettier --check \"src/**/*.{ts,html,css,json}\""
  • CI runs npm run format:check. Ran npm run format once and committed the result.

5) Workflow cleanup

• Fixed ci.yml YAML/indentation and added shell: bash + set -euo pipefail on multi-line steps for reliable fail-fast.
• Added coverage/test artifacts to .gitignore (coverage-out/, coverage-report/, TestResults/).

New CI structure (.github/workflows/ci.yml)

• backend (build + coverage + format): restore → build (Release) → dotnet format --verify-no-changes → bash scripts/coverage-gate.sh
• frontend (build + test + format): npm ci → npm run format:check → npm run build → npx ng test --watch=false (coverage thresholds enforced)
• devsecops (unchanged from R2): gitleaks (working-tree) + dotnet list package --vulnerable + npm audit + Trivy image scans

Files changed (high level)

• New: scripts/coverage-gate.sh, .config/dotnet-tools.json
• Modified: .github/workflows/ci.yml, docanalytics-web/angular.json, docanalytics-web/package.json, .gitignore
• Formatting-only: one-time dotnet format pass (backend) + one-time Prettier pass (frontend) — large file count but no logic changes
• Attributes-only: [ExcludeFromCodeCoverage] added to infra classes

The two "apply format" commits touch many files but are whitespace/formatting only — safe to skim.

How to verify locally

Backend (CI does this on Linux; on Windows run via Git Bash/WSL):