Add CI test-coverage gate at 80%, backfill remaining logic-module gaps

pytest-cov + pyproject.toml [tool.coverage.*] measure reporting.py,
nightscout_client.py, data_processing.py, pdf_export.py, profile_data.py,
ui_common.py, and auth.py; app.py and pages/*.py are omitted (thin
Streamlit UI scripts, not meaningfully unit-testable without a running
Streamlit session — the handful of similarly UI-coupled functions left
in ui_common.py/auth.py are marked "# pragma: no cover" with the same
rationale, since the logic they call into is already fully tested).

The Gitea Actions test job now runs with --cov and fails the build
below 80%; the coverage XML is uploaded as a build artifact and fed
into the SonarQube scan (closing the gap flagged in
homelab-cicd-werkinstructie.md). Backfilled a few missing branches
(get_colors() theme fallback, secondary-y-axis overlay traces) to reach
98% on the measured modules — comfortable headroom above the 80% gate.

Builds on #29/#30/#31.

auth.py

@@ -17,13 +17,18 @@ import os
 import streamlit as st
 
 
-def require_auth() -> None:
+def require_auth() -> None:  # pragma: no cover
     """Blokkeer de pagina totdat het juiste wachtwoord is ingevoerd.
 
     Slaat de status op in st.session_state zodat dit maar één keer per
     browsersessie hoeft. Moet als eerste statement van elke pagina aangeroepen
     worden (app.py en elk bestand in pages/), omdat Streamlit iedere pagina
     als los script uitvoert.
+
+    Pure Streamlit-widget-orkestratie (st.text_input/st.session_state/
+    st.rerun) — buiten scope van de unit-testdekking net als pages/*.py,
+    zie pyproject.toml se coverage-omit-lijst. De veiligheidsrelevante
+    logica zelf (verify_password()) is wel volledig getest.
     """
     if st.session_state.get("authenticated"):
         return