chore(sonar): honest analysis surface — mobile screens/components/hooks + re-justified exclusions (#243 Phase 1)

sonar-project.properties

@@ -1,13 +1,43 @@
 sonar.projectKey=thomasluizon_orbit-ui-mobile
 sonar.organization=thomasluizon
 
-sonar.sources=apps/web/app/,apps/web/components/,apps/web/hooks/,apps/web/stores/,apps/web/lib/,apps/mobile/stores/,apps/mobile/lib/,apps/mobile/modules/orbit-widget/src/,packages/shared/src/
+# Analysis surface. Web analyzes app/components/hooks/stores/lib; mobile now mirrors
+# that (app/components/hooks/stores/lib + the widget module's cross-platform TS) so
+# screens, components, and hooks are analyzed on BOTH platforms, not just web
+# (#243 Phase 1). packages/shared is the cross-platform source of truth.
+sonar.sources=apps/web/app/,apps/web/components/,apps/web/hooks/,apps/web/stores/,apps/web/lib/,apps/mobile/app/,apps/mobile/components/,apps/mobile/hooks/,apps/mobile/stores/,apps/mobile/lib/,apps/mobile/modules/orbit-widget/src/,packages/shared/src/
 sonar.tests=apps/web/__tests__/,apps/mobile/__tests__/,packages/shared/src/__tests__/
 sonar.test.inclusions=**/*.test.ts,**/*.test.tsx,**/*.spec.ts
 
 sonar.javascript.lcov.reportPaths=coverage/lcov.info
 
+# Hard-excluded from analysis entirely: build output, native platform dirs, generated
+# resources, test doubles, and scaffolding configs that carry no product logic.
 sonar.exclusions=**/node_modules/**,.next/**,.expo/**,.turbo/**,dist/**,apps/mobile/test-mocks/**,apps/mobile/scripts/**,apps/mobile/index.js,apps/mobile/metro.config.js,apps/mobile/tailwind.config.js,apps/mobile/modules/**/android/build/**,apps/mobile/modules/**/android/.gradle/**,apps/mobile/modules/**/android/generated/**,apps/mobile/modules/**/android/src/main/**,apps/mobile/modules/**/ios/**
 
-sonar.coverage.exclusions=apps/web/app/**/page.tsx,apps/web/app/**/layout.tsx,apps/web/app/api/**,apps/web/components/**,apps/mobile/lib/google-auth.ts,apps/mobile/lib/offline-queue.ts,apps/mobile/lib/providers.tsx,apps/mobile/lib/theme-provider.tsx,apps/mobile/lib/use-app-theme.ts,apps/mobile/lib/supabase.ts,apps/mobile/lib/orbit-widget.ts,apps/mobile/stores/auth-store.ts,apps/mobile/modules/**,packages/shared/src/theme/button.ts
+# Coverage exclusions — reserved for genuinely untestable code (bootstrap/DI, generated,
+# pure config/tokens, platform glue). One line per entry:
+#   apps/web/app/**/layout.tsx         Next.js root/segment layouts: font + provider + theme bootstrap, no branching.
+#   apps/mobile/app/**/_layout.tsx     Expo Router nav layouts (Tabs/Stack, GestureHandlerRoot); bootstrap parity with web layout.tsx.
+#   apps/web/app/api/**                web BFF route handlers: server-only runtime glue owning the httpOnly-cookie/session lifecycle + upstream proxy; no mobile analog.
+#   apps/mobile/lib/providers.tsx      QueryClient/font/splash/auth-init app-entry wiring.
+#   apps/mobile/lib/theme-provider.tsx theme context + RN Appearance sync + cross-fade animation (RN-coupled bootstrap).
+#   apps/mobile/lib/use-app-theme.ts   thin theme-context accessor with a single runtime-token fallback.
+#   apps/mobile/lib/supabase.ts        RN url-polyfill + expo-sqlite localStorage install at module scope; native-only singleton.
+#   apps/mobile/lib/offline-queue.ts   expo-sqlite at module scope; merge/compaction logic is unit-tested but its lcov is suppressed at the vitest layer.
+#   apps/mobile/lib/orbit-widget.ts    native Android widget bridge (requireNativeModule); pure color helpers are unit-tested, lcov suppressed at vitest layer.
+#   apps/mobile/stores/auth-store.ts   SecureStore-backed session store; JWT/refresh logic is unit-tested, lcov suppressed at vitest layer.
+#   apps/mobile/modules/**             native Android widget module (Kotlin + generated resources + requireNativeModule TS bridge).
+#   packages/shared/src/theme/button.ts static pill-geometry token table, zero branching.
+sonar.coverage.exclusions=apps/web/app/**/layout.tsx,apps/mobile/app/**/_layout.tsx,apps/web/app/api/**,apps/mobile/lib/providers.tsx,apps/mobile/lib/theme-provider.tsx,apps/mobile/lib/use-app-theme.ts,apps/mobile/lib/supabase.ts,apps/mobile/lib/offline-queue.ts,apps/mobile/lib/orbit-widget.ts,apps/mobile/stores/auth-store.ts,apps/mobile/modules/**,packages/shared/src/theme/button.ts
+
+# Duplication exclusions — deliberate structural mirrors/boilerplate that can't be
+# de-duped without harming clarity. One line per entry:
+#   apps/web/app/actions/**                     Server Actions are near-identical serverAuthFetch shells; structural dup is inherent.
+#   apps/mobile/stores/**                       Zustand stores share set/reset scaffolding shape.
+#   apps/mobile/lib/habit-request-builders.ts   re-export barrel of @orbit/shared builders (mirrors web).
+#   apps/mobile/lib/habit-optimistic-helpers.ts optimistic helpers deliberately paralleling the web copy (enforced web/mobile parity).
+#   apps/mobile/lib/plural.ts                   one-line re-export of @orbit/shared/utils/plural.
+#   apps/mobile/lib/theme.ts                    createTokensV2 per-layer token derivation; repetitive shapes mirror the scheme structure.
+#   packages/shared/src/theme/color-schemes.ts  6 near-identical per-scheme literal blocks; data, not logic.
 sonar.cpd.exclusions=apps/web/app/actions/**,apps/mobile/stores/**,apps/mobile/lib/habit-request-builders.ts,apps/mobile/lib/habit-optimistic-helpers.ts,apps/mobile/lib/plural.ts,apps/mobile/lib/theme.ts,packages/shared/src/theme/color-schemes.ts