chore(sonar): wire JaCoCo coverage and clear actionable smells

Fix the SonarQube coverage gate (0% on new code) — a reporting gap, not a
testing gap: the JVM unit suite already exists but the source-only scan
never received a coverage report.

- app/build.gradle.kts: apply jacoco, enable debug unit-test coverage, add a
  jacocoTestReport task (excludes generated/Hilt/Compose-singleton classes)
- sonar-project.properties: consume the JaCoCo XML; exclude pure-@Composable
  UI from coverage (JVM unit tests can't execute composable bodies)
- .gitea/workflows/sonarqube.yml: run JDK 17 + Android SDK +
  `testDebugUnitTest jacocoTestReport` before the scan

Also clear the three actionable code smells: remove an unused import
(AdminContentScreen), remove an unused parameter (AdminSupportScreen.
RespondDialog), and decompose LoginViewModel.submit() (cognitive complexity
20 -> under 15). The remaining 12 smells (snake_case DTO fields that mirror
the JSON wire contract; Compose/nav complexity) are marked Won't Fix in
SonarQube with rationale.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

sonar-project.properties

@@ -20,13 +20,26 @@ sonar.exclusions=**/build/**,**/.gradle/**,**/generated/**
 
 sonar.sourceEncoding=UTF-8
 
-# ── Optional enrichment (enable once the reports are produced in CI) ──
-# For richer Kotlin/Android results, run the reporters in sonarqube.yml and point
-# SonarQube at their output:
-#   • Android Lint:  ./gradlew lintDebug   → app/build/reports/lint-results-debug.xml
+# ── Coverage (JaCoCo) ──
+# sonarqube.yml runs `./gradlew testDebugUnitTest jacocoTestReport` before the scan;
+# that task (app/build.gradle.kts) writes this XML. Without it, Sonar reports 0%
+# coverage even though the JVM unit suite (app/src/test) exists.
+sonar.coverage.jacoco.xmlReportPaths=app/build/reports/jacoco/jacocoTestReport/jacocoTestReport.xml
+
+# Exclude from *coverage* (not from analysis): pure-@Composable UI can't be exercised
+# by JVM unit tests without Robolectric, so counting those lines would unfairly sink
+# new-code coverage. Logic (ViewModels, repositories, core, DTOs) stays measured.
+sonar.coverage.exclusions=\
+  app/src/main/java/**/ui/**/*Screen.kt,\
+  app/src/main/java/**/ui/**/*Screen*.kt,\
+  app/src/main/java/**/ui/theme/**,\
+  app/src/main/java/**/RunicApp.kt,\
+  app/src/main/java/**/MainActivity.kt,\
+  app/src/main/java/**/*Application.kt
+
+# ── Optional enrichment (enable once produced in CI) ──
+#   • Android Lint:  ./gradlew lintDebug → app/build/reports/lint-results-debug.xml
 #     sonar.androidLint.reportPaths=app/build/reports/lint-results-debug.xml
-#   • JaCoCo coverage (needs a coverage-enabled test run):
-#     sonar.coverage.jacoco.xmlReportPaths=app/build/reports/jacoco/.../*.xml
 # The alternative to the CLI scanner used here is the SonarQube Gradle plugin
 # (org.sonarqube), which auto-discovers these reports; the CLI + properties file
 # is used instead to keep this repo's setup identical to website/ and link/.