Test coverage hardening

[Okanmercan99]

Summary

Closes the gaps left by a coverage review of the whole reactor. The short tier
goes from ~161 to 373 tests, all Docker-free and network-free.

Writing those tests exposed eight defects, each fixed here alongside the test
that catches it. Two were proven by reverting the fix and watching the new test
go red.

Why

The review compared every main source against what the suites actually assert.
Three patterns came out:

• Features with no coverage at all — the batching strategy, env-var
  resolution, the job stop/deschedule endpoints, the cst: FHIRPath library.
• Written contracts with no guard — ExtensionRegistry's three fail-fast
  rules, the batch future's archiving guarantee, FhirRepositoryWriter's
  server-specific error handling. All documented in CLAUDE.md as "don't break
  this"; none asserted anywhere.
• Green tests that prove nothing — StreamingSinkHandlerTest had no
  expectation; ignifyr-common, ignifyr-server-common and ignifyr-rxnorm
  ran zero tests under Maven (rxnorm's two suites compiled and were never
  executed).

Defects fixed

Where	Defect
engine/FhirMappingTask	Batch parameter substitution rewrote the prefix of a longer name: with year and yearEnd defined, $yearEnd became 2020End
engine/FileStreamInputArchiver	listFiles() on a not-yet-created checkpoint dir threw an NPE inside the shared archiving TimerTask, killing the timer and stopping archiving for every job in the process
engine/SparkUtil	getLastCommitOffset threw on an empty/absent commit directory
engine/CommandLineInterface	A trailing valueless flag overwrote the command, so run --job reported "unknown command --job"
server/CsvUtil	writeCsvHeaders returned a Future that completed before the write, so the header endpoint could answer OK over stale content (this is what the 5s sleep in MappingContextEndpointTest was papering over)
testkit + server fixtures	Two mapping fixtures still emitted R4-shaped FHIR that the R5 test server rejects — the care-site mapping wrote nothing at all, other-observation lost 3 of 14 resources
connector-sql tests	The "write to FHIR repo successfully" tests asserted only that the cleanup delete returned 200, which is how the two fixture defects above stayed invisible

On the R4→R5 fixture migration

some-folder-1's copy of the same mapping was already migrated, so this is a
half-finished migration rather than a design choice. onFHIR reports only the
first unrecognised element per resource, so it surfaced one layer at a time over
three long-tier runs:
MedicationAdministration.effectiveDateTime -> occurenceDateTime
MedicationAdministration.context -> encounter
MedicationAdministration.medicationCodeableConcept -> medication.concept
MedicationAdministration.category -> array (0..* in R5)
Procedure.performedDateTime -> occurrenceDateTime
Organization.address -> contact[].address

Every replacement was verified by POSTing candidate shapes to an srdc/onfhir:r5
container, not from the spec by memory — note R5 spells
MedicationAdministration.occurence[x] with one r and
Procedure.occurrence[x] with two.

Reviewing commit by commit

The branch is split so each commit builds and passes on its own, and each fix
ships with its guard.

#	Commit	What to look at
1	ci: fail the build when a module's test sources never run	New tier-gate invariant; rxnorm suites moved to the short tier behind a local stub
2	fix(engine): four defects the new unit tests exposed	The four one-to-few-line fixes and their tests
3	fix(server): complete the CSV header write before answering	map → flatMap
4	fix(testkit): finish the R4-to-R5 migration of the mapping fixtures	The six element renames + the strengthened SqlSourceTest assertions
5	test(engine): cover the registry guards, job serialisation and sink routing	Also adds ignifyr-common's first test source set
6	test(server): cover execution control, startup and error handling	Five previously uncovered routes
7	test(plugins): cover the lookup tables and sub-registry guards	The widest untested surfaces: REDCap's 35-branch type table, Kafka coercion, Firely batch attribution

Two structural changes worth a second look:

• Six helpers widened from private to package-private, purely so a fail-fast
  contract could be asserted without standing up a second classloader.
• KafkaSourceReader's coercion moved to the companion object. This is not
  cosmetic: as an instance method the UDF closure would capture the reader and
  therefore the SparkSession, breaking executor serialisation. Logic is
  byte-identical.

Deliberately not changed — your call

Three behaviours are pinned by tests rather than corrected, because changing them
is a product decision, not a cleanup:

• SchemaConverter's asymmetric round-trip. instant reads as
  TimestampType and writes back as dateTime; unsignedInt → LongType →
  integer64. Changing either table rewrites the StructureDefinitions the server
  exports for existing projects.
• RedCapUtil.recordIdField defaults to "", and the CLI path takes that
  default, so CLI-extracted schemas get a record-id field with an empty id and
  a trailing-dot path. Schemas already on disk carry that shape.
• The scheduler fails rather than reseeding when its sync file exists but
  holds no parsable instant (a crash mid-write leaves exactly such a file).
  Falling back to initialTime could re-import a large window.

Also left alone: procedure-occurrence-mapping.json has an unbalanced paren in
its occurrenceDateTime expression. ANTLR recovers, so it evaluates — but it is
pre-existing and unrelated to this PR.

Verification

mvn -B verify                                                    # 373 tests, 0 failures
bash test-flow/check-test-tiers.sh                               # tiers intact
mvn -B verify -pl ignifyr-connector-sql -DskipITs=false          # 12/12  (Docker)
mvn -B verify -pl ignifyr-connector-file -DskipITs=false         # 16/16  (Docker)
mvn -B verify -pl ignifyr-server -DskipITs=false                 # 40/40  (Docker)