test: raise line/branch coverage across library, adapters, and persistence

[wolpert]

Summary

Adds targeted unit and integration tests across every published module to close JaCoCo line/branch coverage gaps. No production code changed — tests only. Every touched module's ./gradlew check (spotless + coverage verify) passes.

Coverage results

Module	Line (before → after)	Branch (before → after)
pk-auth-refresh-tokens	none (gate skipped) → 99%	none → 87%
pk-auth-jwt	82% → 91%	73% → 90%
pk-auth-core	83% → 93%	66% → 78%
pk-auth-micronaut	72% → 93%	39% → 66%
pk-auth-spring-boot-starter	86% → 90%	57% → 77%
pk-auth-dropwizard	78% → 85%	55% → 61%
pk-auth-persistence-dynamodb	83% → 94.5%	44% → 67%
pk-auth-persistence-jdbi	80% → 95%	63% → 69%

What was added

• refresh-tokens — had zero tests and its coverage gate was silently SKIPPED (no execution data). Now driven via RefreshTokenScenarios plus service, handler, record, config, TTL-policy, and deletion-listener tests; the 70% gate is now actually enforced.
• jwt — PkAuthJwtValidator malformed / missing-claim / wrong-shape branches via hand-built signed JWTs, plus JwtClaims and TokenTtlPolicy.
• core — registration happy path (persistRegistration) and evaluateAttestation decisions via a mocked WebAuthn4J RegistrationData chain; in-memory rate limiter / window counter; SPI carrier records; persistence exceptions.
• micronaut / spring / dropwizard — authenticated admin-endpoint paths (list/rename/delete/backup-code count/email+phone verification) and the config-builder factory/auto-config validation + TTL-defaulting branches.
• persistence (jdbi + dynamodb) — repository mutation/bulk paths the shared scenarios don't exercise: credential updateSignCount/updateLabel/delete/deleteByUserHandle, user-lookup register/findViewByHandle, backup-code replaceAll, OTP deleteByUserHandle, refresh deleteExpiredBefore. All against real Postgres / DynamoDB Local via Testcontainers.

Latent issues fixed along the way

• refresh-tokens coverage verification was vacuously skipped (no tests existed) — now enforced.
• The Spring admin integration suite didn't reset the shared in-memory ceremony rate limiter between tests, so added cases tripped the per-IP limit; added a @BeforeEach reset.

Remaining (out of scope)

The residual uncovered code is concentrated in per-repo wrap(...) SDK/JDBI exception-handler catch blocks, which require induced backend failures (fault injection) to reach.

🤖 Generated with Claude Code