test: expand coverage, dedupe data-driven tests, extract shared WebTestCase base (#201)

* test: expand coverage, dedupe data-driven tests, extract shared WebTestCase base

- Add #[CoversClass] to Base64Test and FilenameSanitizerTest
- Merge near-duplicate test methods into #[DataProvider] cases across
  ResetPasswordControllerTest, SettingsControllerTest, ClaimSeasonCommandTest,
  FilenameSanitizerTest, Base64Test, and SeasonRepositoryTest
- Add integration tests for previously untested controllers: public
  QuizController (quiz-taking flow), LoginController, RegistrationController,
  EliminationController, and PrepareEliminationController
- Add unit tests for Elimination and BankQuestion entity logic
- Extract shared WebTestCase setup/helpers (client, entityManager, login,
  entity lookups, CSRF token scraping) into AbstractControllerWebTestCase,
  removing duplicated boilerplate from all 14 WebTestCase files

* test: address PR review feedback

- Scope AbstractControllerWebTestCase::getCandidate/getQuizByName by
  season code (both Candidate and Quiz are only unique per season, not
  system-wide) and add a CandidateRepository regression test guarding
  against same-named candidates in different seasons
- Add missing entityManager->clear() before verifying DB state after a
  POST in PrepareEliminationControllerTest and QuestionBankControllerTest
- Add non-owner denial tests for BackofficeController::exportQuiz and
  QuizQuestionController::edit/reorder, which had IsGranted checks with
  no test coverage

* ci: publish PHPUnit coverage to GitHub code coverage

- Generate a Cobertura report alongside the existing JUnit report and
  upload it with actions/upload-code-coverage so coverage shows up on
  PRs and the default branch via GitHub's code coverage feature
- Add a step to copy both reports out of the php container before
  publishing them, since var/ is a Docker volume (see the Dockerfile's
  VOLUME /app/var/) and isn't bind-mounted to the runner — this also
  fixes the existing JUnit report publishing step, which was silently
  looking at a path that never had contets on the runner

* ci: fix coverage report paths and tolerate Code Quality not yet enabled

- Write PHPUnit's JUnit and Cobertura reports to reports/ instead of
  var/, since var/ is a Docker volume (Dockerfile's VOLUME /app/var/)
  that isn't bind-mounted to the runner - reports written there never
  reached the host, which is also why the prior junit.xml publish step
  had nothing to read. reports/ is a plain path under the project's
  bind mount, so no extra copy-out step is needed
- Set fail-on-error: false on the coverage upload step: it 404s until
  "Code Quality" is turned on for the repo under Settings > Code
  security > Code quality, a one-time manual step

tests/Command/ClaimSeasonCommandTest.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace Tvdt\Tests\Command;
 
 use PHPUnit\Framework\Attributes\CoversClass;
+use PHPUnit\Framework\Attributes\DataProvider;
 use Symfony\Bundle\FrameworkBundle\Console\Application;
 use Symfony\Bundle\FrameworkBundle\Test\KernelTestCase;
 use Symfony\Component\Console\Command\Command;
@@ -48,21 +49,19 @@ final class ClaimSeasonCommandTest extends KernelTestCase
         $this->assertCount(3, $season->owners);
     }
 
-    public function testInvalidEmailFails(): void
+    /** @return iterable<string, array{string, string}> */
+    public static function invalidArgumentsProvider(): iterable
     {
-        $this->commandTester->execute([
-            'season-code' => 'krtek',
-            'email' => 'nonexisting@example.org',
-        ]);
-
-        $this->assertSame(Command::FAILURE, $this->commandTester->getStatusCode());
+        yield 'unknown email' => ['krtek', 'nonexisting@example.org'];
+        yield 'unknown season' => ['dhadk', 'test@example.org'];
     }
 
-    public function testInvalidSeasonCodeFails(): void
+    #[DataProvider('invalidArgumentsProvider')]
+    public function testInvalidArgumentFails(string $seasonCode, string $email): void
     {
         $this->commandTester->execute([
-            'season-code' => 'dhadk',
-            'email' => 'test@example.org',
+            'season-code' => $seasonCode,
+            'email' => $email,
         ]);
 
         $this->assertSame(Command::FAILURE, $this->commandTester->getStatusCode());