Add CI test-coverage gate at 80%, backfill remaining logic-module gaps

pytest-cov + pyproject.toml [tool.coverage.*] measure reporting.py,
nightscout_client.py, data_processing.py, pdf_export.py, profile_data.py,
ui_common.py, and auth.py; app.py and pages/*.py are omitted (thin
Streamlit UI scripts, not meaningfully unit-testable without a running
Streamlit session — the handful of similarly UI-coupled functions left
in ui_common.py/auth.py are marked "# pragma: no cover" with the same
rationale, since the logic they call into is already fully tested).

The Gitea Actions test job now runs with --cov and fails the build
below 80%; the coverage XML is uploaded as a build artifact and fed
into the SonarQube scan (closing the gap flagged in
homelab-cicd-werkinstructie.md). Backfilled a few missing branches
(get_colors() theme fallback, secondary-y-axis overlay traces) to reach
98% on the measured modules — comfortable headroom above the 80% gate.

Builds on #29/#30/#31.

pyproject.toml

@@ -1,2 +1,15 @@
 [tool.pytest.ini_options]
 pythonpath = ["."]
+
+[tool.coverage.run]
+# app.py en pages/*.py zijn dunne Streamlit-UI-scripts (net als de
+# functies in ui_common.py/auth.py die zelf al met "# pragma: no cover"
+# gemarkeerd zijn) — niet zinvol te unit-testen zonder een draaiende
+# Streamlit-sessie, en buiten scope van de coverage-eis. De logica die ze
+# aanroepen (reporting.py, nightscout_client.py, data_processing.py,
+# pdf_export.py, profile_data.py, ui_common.py) wordt wél volledig gemeten.
+omit = ["app.py", "pages/*", "tests/*", ".venv/*"]
+
+[tool.coverage.report]
+fail_under = 80
+show_missing = true