test: expand test suite to 87.3% backend coverage

Add new integration test files covering previously untested routes:
- categories.test.ts — GET /api/categories
- oidc.test.ts — full OIDC login flow (callback, state, errors)
- settings.test.ts — GET/PUT /api/settings, bulk save
- tags.test.ts — CRUD for trip tags
- todo.test.ts — todo items CRUD and reorder

Add new unit test files covering service-layer logic:
- adminService.test.ts — user/invite management, packing templates, OIDC settings
- atlasService.test.ts — atlas search and place enrichment
- authServiceDb.test.ts — DB-backed auth helpers (login, register, MFA)
- backupService.test.ts — export/import/restore logic
- categoryService.test.ts — category CRUD
- dayService.test.ts — day management and accommodation helpers
- mapsService.test.ts — route/directions helpers
- oidcService.test.ts — OIDC state, auth code, role resolution, user upsert
- packingService.test.ts — packing item/bag/template operations
- placeService.test.ts — place CRUD and tag attachment
- settingsService.test.ts — settings get/set/bulk
- tagService.test.ts — tag CRUD
- todoService.test.ts — todo CRUD and reorder
- tripService.test.ts — trip CRUD, member management, archiving
- vacayService.test.ts — vacay integration helpers
- tripAccess.test.ts (middleware) — requireTripAccess middleware

Expand existing integration and unit test files with additional cases
across admin, atlas, auth, backup, collab, days, files, maps, memories
(Immich/Synology), notifications, places, reservations, share, vacay,
weather, auth middleware, ephemeral tokens, notification preferences,
permissions, SSRF guard, and WebSocket connection tests.

Update test helpers (factories.ts, test-db.ts) with new factory
functions and seed data required by the expanded suite.

Fix minor issues in server/src/routes/reservations.ts and
server/src/services/atlasService.ts surfaced by new test coverage.

Update sonar-project.properties to reflect new coverage thresholds.

server/tests/helpers/test-db.ts

@@ -20,48 +20,73 @@ import Database from 'better-sqlite3';
 import { createTables } from '../../src/db/schema';
 import { runMigrations } from '../../src/db/migrations';
 
-// Tables to clear on reset, ordered to avoid FK violations
+// Tables to clear on reset, child-before-parent to be safe (FK checks are OFF during reset).
+// Keep in sync with schema.ts + migrations.ts. Intentionally excluded: categories, addons,
+// photo_providers, photo_provider_fields, schema_version (seed/config data, not user data).
 const RESET_TABLES = [
+  // Collab
   'file_links',
+  'collab_message_reactions',
   'collab_poll_votes',
   'collab_messages',
-  'collab_poll_options',
   'collab_polls',
   'collab_notes',
+  // Day content
   'day_notes',
+  'todo_category_assignees',
+  'todo_items',
   'assignment_participants',
   'day_assignments',
+  // Places
+  'place_regions',
+  'place_tags',
+  'places',
+  // Packing
   'packing_category_assignees',
+  'packing_bag_members',
   'packing_bags',
+  'packing_template_items',
+  'packing_template_categories',
+  'packing_templates',
   'packing_items',
+  // Budget
   'budget_item_members',
   'budget_items',
+  // Photos & files
   'trip_photos',
   'trip_album_links',
   'trip_files',
-  'share_tokens',
   'photos',
+  // Reservations
+  'reservation_day_positions',
   'reservations',
+  // Accommodations & days
   'day_accommodations',
-  'place_tags',
-  'places',
   'days',
+  // Trip
+  'share_tokens',
   'trip_members',
   'trips',
+  // Vacay
   'vacay_entries',
   'vacay_company_holidays',
   'vacay_holiday_calendars',
   'vacay_plan_members',
+  'vacay_user_colors',
+  'vacay_user_years',
   'vacay_years',
   'vacay_plans',
-  'atlas_visited_countries',
-  'atlas_bucket_list',
+  // Atlas
+  'visited_regions',
+  'visited_countries',
+  'bucket_list',
+  // Notifications & audit
   'notification_channel_preferences',
   'notifications',
   'audit_log',
-  'user_settings',
+  // User data
+  'settings',
   'mcp_tokens',
-  'mcp_sessions',
   'invite_tokens',
   'tags',
   'app_settings',
@@ -130,8 +155,13 @@ export function createTestDb(): Database.Database {
  */
 export function resetTestDb(db: Database.Database): void {
   db.exec('PRAGMA foreign_keys = OFF');
+  const existingTables = new Set(
+    (db.prepare("SELECT name FROM sqlite_master WHERE type='table'").all() as { name: string }[]).map(r => r.name)
+  );
   for (const table of RESET_TABLES) {
-    try { db.exec(`DELETE FROM "${table}"`); } catch { /* table may not exist in older schemas */ }
+    if (existingTables.has(table)) {
+      db.exec(`DELETE FROM "${table}"`);
+    }
   }
   db.exec('PRAGMA foreign_keys = ON');
   seedDefaults(db);