test: expand test suite to 87.3% backend coverage

Add new integration test files covering previously untested routes:
- categories.test.ts — GET /api/categories
- oidc.test.ts — full OIDC login flow (callback, state, errors)
- settings.test.ts — GET/PUT /api/settings, bulk save
- tags.test.ts — CRUD for trip tags
- todo.test.ts — todo items CRUD and reorder

Add new unit test files covering service-layer logic:
- adminService.test.ts — user/invite management, packing templates, OIDC settings
- atlasService.test.ts — atlas search and place enrichment
- authServiceDb.test.ts — DB-backed auth helpers (login, register, MFA)
- backupService.test.ts — export/import/restore logic
- categoryService.test.ts — category CRUD
- dayService.test.ts — day management and accommodation helpers
- mapsService.test.ts — route/directions helpers
- oidcService.test.ts — OIDC state, auth code, role resolution, user upsert
- packingService.test.ts — packing item/bag/template operations
- placeService.test.ts — place CRUD and tag attachment
- settingsService.test.ts — settings get/set/bulk
- tagService.test.ts — tag CRUD
- todoService.test.ts — todo CRUD and reorder
- tripService.test.ts — trip CRUD, member management, archiving
- vacayService.test.ts — vacay integration helpers
- tripAccess.test.ts (middleware) — requireTripAccess middleware

Expand existing integration and unit test files with additional cases
across admin, atlas, auth, backup, collab, days, files, maps, memories
(Immich/Synology), notifications, places, reservations, share, vacay,
weather, auth middleware, ephemeral tokens, notification preferences,
permissions, SSRF guard, and WebSocket connection tests.

Update test helpers (factories.ts, test-db.ts) with new factory
functions and seed data required by the expanded suite.

Fix minor issues in server/src/routes/reservations.ts and
server/src/services/atlasService.ts surfaced by new test coverage.

Update sonar-project.properties to reflect new coverage thresholds.

server/tests/unit/services/permissions.test.ts

@@ -1,16 +1,21 @@
 import { describe, it, expect, vi } from 'vitest';
 
+// Mutable rows array so individual tests can inject DB rows
+const dbRows: { key: string; value: string }[] = [];
+
 // Mock database — permissions module queries app_settings at runtime
 vi.mock('../../../src/db/database', () => ({
   db: {
     prepare: () => ({
-      all: () => [], // no custom permissions → fall back to defaults
+      all: () => dbRows, // no custom permissions → fall back to defaults
       run: vi.fn(),
+      get: vi.fn(),
     }),
+    transaction: (fn: () => void) => fn,
   },
 }));
 
-import { checkPermission, getPermissionLevel, PERMISSION_ACTIONS } from '../../../src/services/permissions';
+import { checkPermission, getPermissionLevel, savePermissions, invalidatePermissionsCache, PERMISSION_ACTIONS } from '../../../src/services/permissions';
 
 describe('permissions', () => {
   describe('checkPermission — admin bypass', () => {
@@ -80,4 +85,30 @@ describe('permissions', () => {
       expect(getPermissionLevel('nonexistent_action')).toBe('trip_owner');
     });
   });
+
+  describe('savePermissions — invalid action key is skipped', () => {
+    it('returns skipped array containing invalid action key', () => {
+      const result = savePermissions({ nonexistent_action: 'trip_member' });
+      expect(result.skipped).toContain('nonexistent_action');
+    });
+
+    it('returns skipped array when level is not in allowedLevels for the action', () => {
+      // trip_delete only allows ['admin', 'trip_owner'], so 'trip_member' is invalid
+      const result = savePermissions({ trip_delete: 'trip_member' });
+      expect(result.skipped).toContain('trip_delete');
+    });
+  });
+
+  describe('checkPermission — default case', () => {
+    it('returns false when permission level is an unrecognized value', () => {
+      // Inject a DB row with an unknown level for trip_edit, then invalidate cache
+      dbRows.push({ key: 'perm_trip_edit', value: 'unknown_level' });
+      invalidatePermissionsCache();
+      const result = checkPermission('trip_edit', 'user', 10, 10, false);
+      // Clean up for subsequent tests
+      dbRows.length = 0;
+      invalidatePermissionsCache();
+      expect(result).toBe(false);
+    });
+  });
 });