ci(sonarqube): report test execution so the Unit Tests measure populates

The lcov reports only feed SonarQube's Coverage metric — the "Unit Tests" tile
stayed "-" because we never provided a test-execution report (a separate input
via sonar.testExecutionReportPaths, in SonarQube's own Generic Test Execution
XML format, which the lcov/junit reporters don't produce).

Add a dependency-free custom node:test reporter (scripts/sonar-test-reporter.mjs)
that emits that XML — repo-root-relative <file path> entries matching sonar.tests,
integer-ms durations — and wire it into both the server and client coverage runs
in sonarqube.yml, plus sonar.testExecutionReportPaths in sonar-project.properties.

Verified locally: server 380 + client 43 test cases, well-formed XML, all three
reporters (spec/lcov/sonar) coexist in one `node --test` invocation.

Co-Authored-By: Claude <noreply@anthropic.com>

sonar-project.properties

@@ -22,6 +22,14 @@ sonar.test.inclusions=server/test/**/*.test.js,client/test/**/*.test.js
 # the scanner resolves them against the project base dir.
 sonar.javascript.lcov.reportPaths=server/coverage/lcov.info,client/coverage/lcov.info
 
+# Test execution ("Unit Tests" measure). This is a SEPARATE report from coverage:
+# the lcov files above only populate Coverage, so without this the dashboard shows
+# a coverage % but an empty "Unit Tests" tile. The sonarqube.yml workflow writes
+# these with a custom node:test reporter (scripts/sonar-test-reporter.mjs) that
+# emits SonarQube's Generic Test Execution XML; the <file path=…> entries are
+# repo-root-relative and must fall under sonar.tests above.
+sonar.testExecutionReportPaths=server/coverage/test-execution.xml,client/coverage/test-execution.xml
+
 # Never analyse dependencies, build output, generated specs, or runtime dirs.
 sonar.exclusions=**/node_modules/**,client/dist/**,client/public/**,server/swagger/**,server/logs/**,server/uploads/**,server/coverage/**,client/coverage/**,**/*.min.js