test: raise unit coverage to ~99.9% and enforce thresholds

[Bccorb]

Summary

A large testing push that takes CLI unit coverage from 23.2% to 99.9% lines, then adds Vitest coverage thresholds so the level is enforced going forward.

Stacked on top of #63 (the coverage-badge PR); this PR is targeted at that branch so the diff is only the test work. Merge #63 first, or retarget to main after it lands.

Coverage

Metric	Before	After
Lines	23.2%	99.88%
Statements	23.2%	99.88%
Functions	-	99.61%
Branches	-	96.92%

552 tests (548 passing, 4 pre-existing skipped e2e). 44 new/updated *.test.ts files covering every command, core module, generator, prompt, util, and the entry dispatcher.

Approach

• Tests are co-located *.test.ts and follow the repo's existing dependency-injection style (e.g. setBackendForTesting, injected clients/fetch, the fakeClient pattern).
• External boundaries are mocked without touching source: @clack/prompts, fs, child_process, network (fetch), @napi-rs/keyring, and adm-zip (via real in-memory zip fixtures).
• Command tests spy process.exit (throw-to-short-circuit) and assert user-facing output, request shapes, and exit codes.
• src/index.ts (which runs main() at import) is tested by mocking every command module and re-importing per argv scenario with vi.resetModules().
• No source files were modified anywhere in this PR: it is test-only plus the vitest.config.ts threshold block.

Thresholds (the enforced "limits")

Added to vitest.config.ts, set just below current numbers as a regression floor:

thresholds: { lines: 99, statements: 99, functions: 99, branches: 95 }

npm run coverage (and therefore the pre-commit hook from #63) now fails if coverage drops below these.

Remaining uncovered (7 lines)

All are genuinely unreachable branches, documented rather than papered over:

• src/generators/docker/docker.ts (5 lines): a private multiline-env helper; values reaching it come from parseEnvString/secret generators and can never contain a newline.
• The remaining branch gaps are ??/optional-chaining default operands whose lines are fully covered.

Checks

• npm run coverage passes with thresholds enforced (exit 0)
• npm run build passes
• Pre-commit hook ran on this commit and regenerated the badge (now 99.9%)