test(core): cover the DB layer — ModuleMigrator, SettingsRepository, AuthRepository

Fifth coverage batch, all driven against the in-memory SQLite TestDb:

- ModuleMigratorTest: install runs master database.sql (or falls back to
  replaying deltas <= target when there is none); up() applies only the
  (from, to] range ascending; uninstall runs database_drop.sql or no-ops; has()
  and discover() semver rules (non-semver files ignored, comments stripped);
  and failure propagation from a bad statement.
- SettingsRepositoryTest: getAll() JSON/CSV field normalisation (allow_countries,
  allowed_stb_types lowercase/trim/blank-drop, bouquet_name spaces, api_ips,
  shared_mount_prefixes incl. the legacy-CSV self-heal) and empty-list collapse.
  Points CACHE_TMP_PATH at a temp dir for the trailing FileCache write.
- AuthRepositoryTest: access-code and HMAC-key reads (getAllCodes with/without
  type filter, getCodeById, getCurrentCode via XC_CODE, getAllHMAC, getHMACById)
  and deleteHMAC existing/missing. getGroupPermissions (JSON_CONTAINS) and
  deleteCode (nginx config regen) are left for integration.

+20 tests. Suite: 678 tests, 0 errors.

tests/Unit/AuthRepositoryTest.php

@@ -0,0 +1,78 @@
+<?php
+
+use XcVm\Core\Auth\AuthRepository;
+use PHPUnit\Framework\TestCase;
+
+/**
+ * AuthRepository — access-code and HMAC-key reads/deletes. Covers the
+ * SQLite-compatible query methods against an in-memory database injected via
+ * the $db global. (getGroupPermissions uses MySQL JSON_CONTAINS and deleteCode
+ * regenerates nginx configs, so both are left to integration tests.)
+ */
+final class AuthRepositoryTest extends TestCase {
+
+	private TestDb $db;
+	private array $serverBackup;
+
+	protected function setUp(): void {
+		$this->serverBackup = $_SERVER;
+		$this->db = new TestDb();
+		$this->db->exec(
+			'CREATE TABLE access_codes (id INTEGER PRIMARY KEY, type INTEGER, code TEXT);
+			 CREATE TABLE hmac_keys (id INTEGER PRIMARY KEY, key TEXT);
+			 INSERT INTO access_codes (id, type, code) VALUES (1, 0, "alpha"), (2, 1, "beta"), (3, 0, "gamma");
+			 INSERT INTO hmac_keys (id, key) VALUES (7, "k7"), (8, "k8");'
+		);
+		$GLOBALS['db'] = $this->db;
+	}
+
+	protected function tearDown(): void {
+		$_SERVER = $this->serverBackup;
+		unset($GLOBALS['db']);
+	}
+
+	public function testGetAllCodesKeyedById(): void {
+		$codes = AuthRepository::getAllCodes();
+		$this->assertSame([1, 2, 3], array_keys($codes));
+		$this->assertSame('beta', $codes[2]['code']);
+	}
+
+	public function testGetAllCodesFilteredByType(): void {
+		$codes = AuthRepository::getAllCodes(0);
+		$this->assertSame([1, 3], array_keys($codes), 'only type 0');
+	}
+
+	public function testGetCodeByIdReturnsRowOrNull(): void {
+		$this->assertSame('alpha', AuthRepository::getCodeById(1)['code']);
+		$this->assertNull(AuthRepository::getCodeById(999));
+	}
+
+	public function testGetCurrentCodeReadsXcCodeServerParam(): void {
+		$_SERVER['XC_CODE'] = 'gamma';
+		$this->assertSame('gamma', AuthRepository::getCurrentCode());
+
+		$row = AuthRepository::getCurrentCode(true);
+		$this->assertSame(3, (int) $row['id'], 'full row when $rInfo = true');
+
+		$_SERVER['XC_CODE'] = 'no_such_code';
+		$this->assertNull(AuthRepository::getCurrentCode(true));
+	}
+
+	public function testGetAllHmacKeyedById(): void {
+		$keys = AuthRepository::getAllHMAC();
+		$this->assertSame([7, 8], array_keys($keys));
+		$this->assertSame('k7', $keys[7]['key']);
+	}
+
+	public function testGetHmacByIdReturnsRowOrNull(): void {
+		$this->assertSame('k8', AuthRepository::getHMACById(8)['key']);
+		$this->assertNull(AuthRepository::getHMACById(999));
+	}
+
+	public function testDeleteHmacRemovesExistingAndReportsMissing(): void {
+		$this->assertTrue(AuthRepository::deleteHMAC(7));
+		$this->assertNull(AuthRepository::getHMACById(7), 'gone after delete');
+		$this->assertFalse(AuthRepository::deleteHMAC(7), 'already deleted');
+		$this->assertFalse(AuthRepository::deleteHMAC(999));
+	}
+}