test: expand coverage, dedupe data-driven tests, extract shared WebTestCase base

- Add #[CoversClass] to Base64Test and FilenameSanitizerTest
- Merge near-duplicate test methods into #[DataProvider] cases across
  ResetPasswordControllerTest, SettingsControllerTest, ClaimSeasonCommandTest,
  FilenameSanitizerTest, Base64Test, and SeasonRepositoryTest
- Add integration tests for previously untested controllers: public
  QuizController (quiz-taking flow), LoginController, RegistrationController,
  EliminationController, and PrepareEliminationController
- Add unit tests for Elimination and BankQuestion entity logic
- Extract shared WebTestCase setup/helpers (client, entityManager, login,
  entity lookups, CSRF token scraping) into AbstractControllerWebTestCase,
  removing duplicated boilerplate from all 14 WebTestCase files

tests/Controller/LoginControllerTest.php

@@ -0,0 +1,53 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Tvdt\Tests\Controller;
+
+use PHPUnit\Framework\Attributes\CoversClass;
+use Symfony\Component\HttpFoundation\Request;
+use Tvdt\Controller\LoginController;
+
+#[CoversClass(LoginController::class)]
+final class LoginControllerTest extends AbstractControllerWebTestCase
+{
+    public function testLoginPageLoadsWhenNotAuthenticated(): void
+    {
+        $this->client->request(Request::METHOD_GET, '/login');
+
+        self::assertResponseIsSuccessful();
+        self::assertSelectorExists('form');
+    }
+
+    public function testLoginRedirectsToBackofficeWhenAlreadyAuthenticated(): void
+    {
+        $this->loginAs('test@example.org');
+
+        $this->client->request(Request::METHOD_GET, '/login');
+
+        self::assertResponseRedirects('/backoffice/');
+    }
+
+    public function testLoginWithInvalidCredentialsShowsFlash(): void
+    {
+        $this->client->request(Request::METHOD_GET, '/login');
+        $form = $this->client->getCrawler()->filter('form')->form([
+            '_username' => 'test@example.org',
+            '_password' => 'wrong-password',
+        ]);
+        $this->client->submit($form);
+
+        self::assertResponseRedirects('/login');
+        $this->client->followRedirect();
+        self::assertSelectorTextContains('body', 'Ongeldige inloggegevens.');
+    }
+
+    public function testLogoutIsInterceptedByFirewall(): void
+    {
+        $this->loginAs('test@example.org');
+
+        $this->client->request(Request::METHOD_GET, '/logout');
+
+        self::assertResponseRedirects();
+    }
+}