Add CI test-coverage gate at 80%, backfill remaining logic-module gaps

pytest-cov + pyproject.toml [tool.coverage.*] measure reporting.py,
nightscout_client.py, data_processing.py, pdf_export.py, profile_data.py,
ui_common.py, and auth.py; app.py and pages/*.py are omitted (thin
Streamlit UI scripts, not meaningfully unit-testable without a running
Streamlit session — the handful of similarly UI-coupled functions left
in ui_common.py/auth.py are marked "# pragma: no cover" with the same
rationale, since the logic they call into is already fully tested).

The Gitea Actions test job now runs with --cov and fails the build
below 80%; the coverage XML is uploaded as a build artifact and fed
into the SonarQube scan (closing the gap flagged in
homelab-cicd-werkinstructie.md). Backfilled a few missing branches
(get_colors() theme fallback, secondary-y-axis overlay traces) to reach
98% on the measured modules — comfortable headroom above the 80% gate.

Builds on #29/#30/#31.

.gitea/workflows/pipeline.yml

@@ -19,11 +19,21 @@ jobs:
         run: pip install -r requirements.txt
       - name: Lint (ruff)
         run: ruff check .
-      - name: Unit tests (pytest)
-        run: pytest tests/ -v
+      - name: Unit tests + coverage-gate (pytest)
+        # fail_under (pyproject.toml, [tool.coverage.report]) laat deze stap
+        # falen als de dekking op de gemeten modules onder 80% zakt — app.py/
+        # pages/*.py zijn uitgesloten (zie pyproject.toml se coverage-omit),
+        # dat zijn dunne Streamlit-UI-scripts die niet zinvol te unit-testen
+        # zijn zonder een draaiende Streamlit-sessie.
+        run: pytest tests/ -v --cov=. --cov-report=term-missing --cov-report=xml
+      - name: Bewaar coverage-rapport
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: coverage.xml
 
   # ---------------------------------------------------------------------
-  # 2. SonarQube — codekwaliteit-gate
+  # 2. SonarQube — codekwaliteit-gate (incl. coverage uit de vorige stap)
   # ---------------------------------------------------------------------
   sonarqube:
     runs-on: ubuntu-latest
@@ -32,6 +42,10 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0 # SonarQube wil de volledige git-historie zien
+      - name: Download coverage-rapport
+        uses: actions/download-artifact@v4
+        with:
+          name: coverage-report
       - name: SonarQube scan
         uses: sonarsource/sonarqube-scan-action@v6
         env: