test: expand test suite to 87.3% backend coverage

Add new integration test files covering previously untested routes:
- categories.test.ts — GET /api/categories
- oidc.test.ts — full OIDC login flow (callback, state, errors)
- settings.test.ts — GET/PUT /api/settings, bulk save
- tags.test.ts — CRUD for trip tags
- todo.test.ts — todo items CRUD and reorder

Add new unit test files covering service-layer logic:
- adminService.test.ts — user/invite management, packing templates, OIDC settings
- atlasService.test.ts — atlas search and place enrichment
- authServiceDb.test.ts — DB-backed auth helpers (login, register, MFA)
- backupService.test.ts — export/import/restore logic
- categoryService.test.ts — category CRUD
- dayService.test.ts — day management and accommodation helpers
- mapsService.test.ts — route/directions helpers
- oidcService.test.ts — OIDC state, auth code, role resolution, user upsert
- packingService.test.ts — packing item/bag/template operations
- placeService.test.ts — place CRUD and tag attachment
- settingsService.test.ts — settings get/set/bulk
- tagService.test.ts — tag CRUD
- todoService.test.ts — todo CRUD and reorder
- tripService.test.ts — trip CRUD, member management, archiving
- vacayService.test.ts — vacay integration helpers
- tripAccess.test.ts (middleware) — requireTripAccess middleware

Expand existing integration and unit test files with additional cases
across admin, atlas, auth, backup, collab, days, files, maps, memories
(Immich/Synology), notifications, places, reservations, share, vacay,
weather, auth middleware, ephemeral tokens, notification preferences,
permissions, SSRF guard, and WebSocket connection tests.

Update test helpers (factories.ts, test-db.ts) with new factory
functions and seed data required by the expanded suite.

Fix minor issues in server/src/routes/reservations.ts and
server/src/services/atlasService.ts surfaced by new test coverage.

Update sonar-project.properties to reflect new coverage thresholds.

server/tests/integration/days.test.ts

@@ -434,6 +434,46 @@ describe('Accommodations', () => {
     expect(reservation.confirmation_number).toBe('CONF-XYZ');
   });
 
+  it('ACCOM-004 — PUT /api/trips/:tripId/accommodations/:id updates the accommodation', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id, { title: 'Hotel Trip' });
+    const day1 = createDay(testDb, trip.id, { date: '2026-10-20' });
+    const day2 = createDay(testDb, trip.id, { date: '2026-10-22' });
+    const day3 = createDay(testDb, trip.id, { date: '2026-10-25' });
+    const place = createPlace(testDb, trip.id, { name: 'City Inn' });
+
+    const createRes = await request(app)
+      .post(`/api/trips/${trip.id}/accommodations`)
+      .set('Cookie', authCookie(user.id))
+      .send({ place_id: place.id, start_day_id: day1.id, end_day_id: day2.id, notes: 'Original' });
+
+    expect(createRes.status).toBe(201);
+    const accommodationId = createRes.body.accommodation.id;
+
+    const updateRes = await request(app)
+      .put(`/api/trips/${trip.id}/accommodations/${accommodationId}`)
+      .set('Cookie', authCookie(user.id))
+      .send({ place_id: place.id, start_day_id: day1.id, end_day_id: day3.id, notes: 'Extended stay' });
+
+    expect(updateRes.status).toBe(200);
+    expect(updateRes.body.accommodation).toBeDefined();
+    expect(updateRes.body.accommodation.end_day_id).toBe(day3.id);
+    expect(updateRes.body.accommodation.notes).toBe('Extended stay');
+  });
+
+  it('ACCOM-004 — PUT non-existent accommodation returns 404', async () => {
+    const { user } = createUser(testDb);
+    const trip = createTrip(testDb, user.id, { title: 'Trip' });
+
+    const res = await request(app)
+      .put(`/api/trips/${trip.id}/accommodations/999999`)
+      .set('Cookie', authCookie(user.id))
+      .send({ notes: 'Ghost update' });
+
+    expect(res.status).toBe(404);
+    expect(res.body.error).toMatch(/not found/i);
+  });
+
   it('ACCOM-003 — Deleting accommodation also removes the linked reservation', async () => {
     const { user } = createUser(testDb);
     const trip = createTrip(testDb, user.id, { title: 'Hotel Trip' });