chore(sonar): wire JaCoCo coverage and clear actionable smells

Fix the SonarQube coverage gate (0% on new code) — a reporting gap, not a
testing gap: the JVM unit suite already exists but the source-only scan
never received a coverage report.

- app/build.gradle.kts: apply jacoco, enable debug unit-test coverage, add a
  jacocoTestReport task (excludes generated/Hilt/Compose-singleton classes)
- sonar-project.properties: consume the JaCoCo XML; exclude pure-@Composable
  UI from coverage (JVM unit tests can't execute composable bodies)
- .gitea/workflows/sonarqube.yml: run JDK 17 + Android SDK +
  `testDebugUnitTest jacocoTestReport` before the scan

Also clear the three actionable code smells: remove an unused import
(AdminContentScreen), remove an unused parameter (AdminSupportScreen.
RespondDialog), and decompose LoginViewModel.submit() (cognitive complexity
20 -> under 15). The remaining 12 smells (snake_case DTO fields that mirror
the JSON wire contract; Compose/nav complexity) are marked Won't Fix in
SonarQube with rationale.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

app/build.gradle.kts

@@ -10,6 +10,11 @@ plugins {
     alias(libs.plugins.kotlin.serialization)
     alias(libs.plugins.ksp)
     alias(libs.plugins.hilt)
+    jacoco
+}
+
+jacoco {
+    toolVersion = "0.8.12"
 }
 
 // Release signing material (PLAN.md §12) is never committed. It is read from, in
@@ -78,6 +83,11 @@ android {
     }
 
     buildTypes {
+        debug {
+            // Produce a JaCoCo .exec from JVM unit tests so SonarQube receives real
+            // coverage (§12.1). Debug-only: the scan analyses the debug variant.
+            enableUnitTestCoverage = true
+        }
         release {
             // R8 full-mode minify + resource shrink (§7: no offline cache, so a lean
             // release APK). Keep rules live in proguard-rules.pro.
@@ -170,3 +180,35 @@ dependencies {
     androidTestImplementation(platform(libs.androidx.compose.bom))
     androidTestImplementation(libs.androidx.compose.ui.test.junit4)
 }
+
+// JaCoCo XML coverage from the JVM unit tests, consumed by SonarQube (§12.1). Generated,
+// DI (Hilt), and Compose-scaffold classes are excluded so they don't dilute the number;
+// pure-@Composable UI is excluded on the Sonar side (sonar.coverage.exclusions) because
+// JVM unit tests can't execute composable bodies without Robolectric.
+tasks.register<JacocoReport>("jacocoTestReport") {
+    dependsOn("testDebugUnitTest")
+    group = "verification"
+    description = "Generates JaCoCo XML/HTML coverage for the debug unit tests."
+
+    reports {
+        xml.required.set(true)
+        html.required.set(true)
+    }
+
+    val coverageExcludes = listOf(
+        "**/R.class", "**/R$*.class", "**/BuildConfig.*", "**/Manifest*.*",
+        "**/*_Hilt*.*", "**/Hilt_*.*", "**/*_Factory*.*", "**/*_MembersInjector*.*",
+        "**/*_Impl*.*", "**/di/**", "**/*Module.*", "**/*Module$*.*",
+        "**/*ComposableSingletons*.*", "**/ComposableSingletons$*.*",
+    )
+    val buildDirFile = layout.buildDirectory.get().asFile
+    classDirectories.setFrom(
+        fileTree("$buildDirFile/tmp/kotlin-classes/debug") { exclude(coverageExcludes) },
+    )
+    sourceDirectories.setFrom(files("src/main/java", "src/main/kotlin"))
+    executionData.setFrom(
+        fileTree(buildDirFile) {
+            include("outputs/unit_test_code_coverage/debugUnitTest/testDebugUnitTest.exec")
+        },
+    )
+}

app/src/main/java/com/runicgateway/app/ui/admin/AdminContentScreen.kt

@@ -30,7 +30,6 @@ import androidx.compose.runtime.Composable
 import androidx.compose.runtime.getValue
 import androidx.compose.runtime.mutableIntStateOf
 import androidx.compose.runtime.mutableStateOf
-import androidx.compose.runtime.remember
 import androidx.compose.runtime.saveable.rememberSaveable
 import androidx.compose.runtime.setValue
 import androidx.compose.ui.Alignment

app/src/main/java/com/runicgateway/app/ui/admin/AdminSupportScreen.kt

@@ -84,7 +84,6 @@ fun AdminSupportScreen(
 
     replyTo?.let { page ->
         RespondDialog(
-            page = page,
             onDismiss = { replyTo = null },
             onSend = { message, close ->
                 viewModel.respond(page.pageId, message, close)
@@ -122,7 +121,6 @@ private fun SupportPageCard(
 
 @Composable
 private fun RespondDialog(
-    page: SupportPageDto,
     onDismiss: () -> Unit,
     onSend: (message: String, close: Boolean) -> Unit,
 ) {

app/src/main/java/com/runicgateway/app/ui/auth/LoginViewModel.kt

@@ -153,18 +153,11 @@ class LoginViewModel @Inject constructor(
     fun submit() {
         val s = _state.value
         if (s.submitting) return
-        if (s.username.isBlank() || s.password.isBlank()) {
-            _state.update { it.copy(error = LoginError.INVALID_CREDENTIALS) }
+        val validationError = validateForSubmit(s)
+        if (validationError != null) {
+            _state.update { it.copy(error = validationError) }
             return
         }
-        // If 2FA is being requested, the chosen second factor must accompany the resubmit.
-        if (s.totpRequired) {
-            val factor = if (s.useRecoveryCode) s.recoveryCode else s.code
-            if (factor.isBlank()) {
-                _state.update { it.copy(error = LoginError.BAD_CODE) }
-                return
-            }
-        }
 
         _state.update { it.copy(submitting = true, error = null) }
         viewModelScope.launch {
@@ -178,36 +171,50 @@ class LoginViewModel @Inject constructor(
                 recoveryCode = recoveryCode,
                 trustDevice = s.trustDevice,
             )
-            when (result) {
-                is LoginResult.Success ->
-                    // The trusted-device cap (result.trustLimitReached) is an edge case:
-                    // login succeeded but the device wasn't remembered. It's surfaced +
-                    // managed on the Trusted Devices screen rather than blocking sign-in.
-                    _state.update { it.copy(submitting = false, signedIn = true) }
-
-                LoginResult.TotpRequired ->
-                    // Reveal the 2FA fields; a wrong code/recovery code re-lands here as BAD_CODE.
-                    _state.update {
-                        val hadFactor = if (it.useRecoveryCode) it.recoveryCode.isNotBlank() else it.code.isNotBlank()
-                        it.copy(
-                            submitting = false,
-                            totpRequired = true,
-                            error = if (hadFactor) LoginError.BAD_CODE else null,
-                        )
-                    }
-
-                LoginResult.InvalidCredentials ->
-                    _state.update { it.copy(submitting = false, error = LoginError.INVALID_CREDENTIALS) }
-
-                LoginResult.RateLimited ->
-                    _state.update { it.copy(submitting = false, error = LoginError.RATE_LIMITED) }
-
-                LoginResult.ServerError ->
-                    _state.update { it.copy(submitting = false, error = LoginError.SERVER) }
-
-                LoginResult.NetworkError ->
-                    _state.update { it.copy(submitting = false, error = LoginError.NETWORK) }
-            }
+            applyLoginResult(result)
         }
     }
+
+    /** Pre-flight form checks for [submit]; returns the error to surface, or null if ready to send. */
+    private fun validateForSubmit(s: UiState): LoginError? {
+        if (s.username.isBlank() || s.password.isBlank()) return LoginError.INVALID_CREDENTIALS
+        // If 2FA is being requested, the chosen second factor must accompany the resubmit.
+        if (s.totpRequired) {
+            val factor = if (s.useRecoveryCode) s.recoveryCode else s.code
+            if (factor.isBlank()) return LoginError.BAD_CODE
+        }
+        return null
+    }
+
+    /** Folds a [LoginResult] back into the UI state (clears [UiState.submitting] on every path). */
+    private fun applyLoginResult(result: LoginResult) = when (result) {
+        is LoginResult.Success ->
+            // The trusted-device cap (result.trustLimitReached) is an edge case:
+            // login succeeded but the device wasn't remembered. It's surfaced +
+            // managed on the Trusted Devices screen rather than blocking sign-in.
+            _state.update { it.copy(submitting = false, signedIn = true) }
+
+        LoginResult.TotpRequired ->
+            // Reveal the 2FA fields; a wrong code/recovery code re-lands here as BAD_CODE.
+            _state.update {
+                val hadFactor = if (it.useRecoveryCode) it.recoveryCode.isNotBlank() else it.code.isNotBlank()
+                it.copy(
+                    submitting = false,
+                    totpRequired = true,
+                    error = if (hadFactor) LoginError.BAD_CODE else null,
+                )
+            }
+
+        LoginResult.InvalidCredentials ->
+            _state.update { it.copy(submitting = false, error = LoginError.INVALID_CREDENTIALS) }
+
+        LoginResult.RateLimited ->
+            _state.update { it.copy(submitting = false, error = LoginError.RATE_LIMITED) }
+
+        LoginResult.ServerError ->
+            _state.update { it.copy(submitting = false, error = LoginError.SERVER) }
+
+        LoginResult.NetworkError ->
+            _state.update { it.copy(submitting = false, error = LoginError.NETWORK) }
+    }
 }