test: raise line coverage to 95.6% - #688

Raises combined line coverage from 91.4% to 95.6% (frontend 93.7%, backend 96.2%). The bugs these tests turned up were fixed in #687.

Backend

• createAppHarness() loads all of app.js in a vm context, with the modules a test names swapped for stand-ins and nothing started, so a test can put it through failures a real server is hard to set up: a database write that throws, a provider that is down, a client that leaves mid-download. createRouteHarness() builds on it to call a route's handler directly. CONTRIBUTING says when to use these and when to use startApp(), which still covers authentication and permissions.
• Tests on them for OIDC callbacks, Telegram requests, snip jobs, playlist and subscription archives, transcoded streams, subtitles, artwork, server updates and backups, TLS startup and Redis reconnects. The update tests now load all of app.js instead of a slice of it, so they count toward its coverage.
• Downloader recovery (failed playlist probes, chunked playlists, members-only items, archived skips), file metadata, and media utilities (sidecars, folder scans, snips that fall back from hardware to software).
• The MongoDB stand-in learns $count, which the duplicate summary uses.

Frontend: themes, sign-in and registration errors, the OIDC redirect, player queues and chapters, bulk download actions, archive imports, search results, format selection, several dialogs, and the password hidden in the simulated command.

Removed: six functions in authentication/auth.js and one in config.js that nothing calls, among them a JWT check that read the token from the query string and a removePlaylist that deleted from a playlist table that does not exist.

Updates the README badge from 91.4% to 95.6%, measured with the local LDAP harness enabled.

Validation on Node 26.13.0:

• Frontend: 1,514 passing
• Backend with LDAP: 1,534 passing, 10 pending
• Combined line coverage: 33,067 / 34,578 lines (95.6%); no source files missing from either report
• Lint passed