test(api): 100% patch coverage on cli-complete + ignored_fields/recycle branches

Closes the 100%-patch-coverage CI gate on #283. The e2e tests that exercised
these lines are build-tagged (excluded from the -short coverage run), so the
new handler error-arms showed as uncovered. Added UNIT tests + two minimal
test seams.

cli_auth.go (CompleteCLISessionHandler, D2): white-box tests in
cli_auth_coverage_test.go drive every error arm — missing/blank session id,
Redis-read failure, corrupt session blob, idempotent already-complete, non-UUID
team/user locals, team-not-found + team-lookup DB error, keygen failure,
CreateAPIKey failure, best-effort resource-list failure, happy-path session
flip (incl. the token-gathering loop), and the final session-write failure
(injected via a go-redis SET-failing hook). Handler now 100%.

provision_helper.go:
  - recycleClaimURL (F1): the existing mint-failed test could not force the
    failure (HMAC over any []byte key signs), so issueOnboardingJWT is now
    reached through the issueOnboardingJWTFn seam; rewrote the test to force the
    bare-URL fallback and added the mint-success (embeds-JWT) arm. 100%.
  - knownJSONFields / collectJSONFields (D7): added reflection-edge tests —
    typed nil pointer, non-struct input, pointer-to-pointer, anonymous
    *struct embed, unexported non-embedded field, non-struct in collectJSONFields,
    non-object body, empty object. Both 100%.
  - parseProvisionBody content-type charset-strip + 415 arm covered directly.

Test seams generateAPIKeyPlaintextFn (cli_auth.go) and issueOnboardingJWTFn
(provision_helper.go) both default to the real func/method — zero prod
behavior change — mirroring the existing promoteDeploymentTTLsForTeamFn pattern
in billing.go.

diff-cover vs origin/master: 213 changed lines, 0 missing, 100%.
golangci-lint ./internal/handlers/ → 0 issues.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: mastermanas805

internal/handlers/cli_auth.go

@@ -280,7 +280,7 @@ func (h *CLIAuthHandler) CompleteCLISessionHandler(c *fiber.Ctx) error {
 	// Mint the long-lived team API key the CLI persists. Plaintext is returned
 	// to the caller exactly once (here, via the completed Redis state → the
 	// CLI's poll); only the SHA-256 is stored.
-	plaintext, err := models.GenerateAPIKeyPlaintext()
+	plaintext, err := generateAPIKeyPlaintextFn()
 	if err != nil {
 		slog.Error("cli_auth.complete.keygen", "request_id", requestID, "error", err)
 		return respondError(c, fiber.StatusServiceUnavailable, "key_generation_failed",
@@ -337,6 +337,14 @@ func (h *CLIAuthHandler) CompleteCLISessionHandler(c *fiber.Ctx) error {
 // dashboard-minted ones in the team's key list.
 const cliAPIKeyName = "CLI login"
 
+// generateAPIKeyPlaintextFn is the seam through which CompleteCLISessionHandler
+// mints the CLI PAT. It indirects to models.GenerateAPIKeyPlaintext in prod;
+// tests override it to exercise the (otherwise-unreachable) crypto/rand failure
+// arm — GenerateAPIKeyPlaintext only errors when crypto/rand.Read does, which
+// cannot be injected without a seam. Mirrors the promoteDeploymentTTLsForTeamFn
+// pattern in billing.go.
+var generateAPIKeyPlaintextFn = models.GenerateAPIKeyPlaintext
+
 // CompleteCLISession is called by the OAuth callback handler after a user
 // successfully authenticates. It writes the result into Redis so the CLI's
 // polling loop picks it up.