ci(sonarqube): generate and report server test coverage

SonarQube reported 0% coverage because the analysis workflow never ran
the test suite — the scanner does static analysis only and was handed no
coverage report, and sonar-project.properties defined no report path.

Generate an LCOV report in sonarqube.yml before the scan using Node's
built-in test coverage (run from the repo root so SF: paths are
server/src/... and resolve against the project base dir), and point
the scanner at it via sonar.javascript.lcov.reportPaths. Node's lcov
coverage reporter needs Node >= 22, so the coverage job pins node 22.

Co-Authored-By: Claude <noreply@anthropic.com>

sonar-project.properties

@@ -14,7 +14,14 @@ sonar.sources=server/src,client/src,bot/src
 sonar.tests=server/test
 sonar.test.inclusions=server/test/**/*.test.js
 
+# Coverage. The sonarqube.yml workflow runs the server suite with Node's built-in
+# test-coverage and writes an LCOV report here BEFORE the scan runs; without it
+# the dashboard shows 0% (the scanner never executes tests itself). The SF: paths
+# in the report are repo-root-relative (server/src/...) so the scanner resolves
+# them against the project base dir.
+sonar.javascript.lcov.reportPaths=server/coverage/lcov.info
+
 # Never analyse dependencies, build output, generated specs, or runtime dirs.
-sonar.exclusions=**/node_modules/**,client/dist/**,client/public/**,server/swagger/**,server/logs/**,server/uploads/**,**/*.min.js
+sonar.exclusions=**/node_modules/**,client/dist/**,client/public/**,server/swagger/**,server/logs/**,server/uploads/**,server/coverage/**,**/*.min.js
 
 sonar.sourceEncoding=UTF-8