test: add integration and unit tests for dashboard, emby, sonarr, radarr, sabnzbd routes

- tests/unit/dashboard.test.js: 58 unit tests covering all 12 pure helper
  functions in dashboard.js (sanitizeTagLabel, tagMatchesUser, getCoverArt,
  extractAllTags, extractUserTag, getImportIssues, getSonarrLink, getRadarrLink,
  canBlocklist, extractEpisode, gatherEpisodes, buildTagBadges)

- tests/integration/dashboard.test.js: 35 integration tests for
  /user-downloads (SAB+Sonarr, SAB+Radarr, qBit, showAll, paused queue,
  history matching, importIssues, wrong-user filtering), /status (admin guard,
  webhook check, failure handling), /webhook-metrics, /cover-art (all
  validation/proxy paths), /blocklist-search (guards, Sonarr, Radarr, failure)

- tests/integration/emby.test.js: 13 integration tests covering all 4 Emby
  routes (sessions, users, users/:id, session/:id/user) with auth guard,
  happy path, and upstream failure cases

- tests/integration/arrRoutes.test.js: 64 integration tests for Sonarr +
  Radarr (queue, history, series/movies, notifications CRUD, /test, /schema,
  /sofarr-webhook create+update+missing-config+failure) and SABnzbd (queue,
  history with custom params)

- vitest.config.js: raise global coverage thresholds (statements/functions/
  lines 20->55, branches 8->40) to reflect improved coverage
  (62.5% stmts, 42.6% branches, 64.1% funcs, 65.6% lines)

- tests/README.md: document new test files and update coverage table

vitest.config.js

@@ -28,14 +28,15 @@ export default defineConfig({
       // Global thresholds only — per-file thresholds are avoided because V8's
       // coverage counting varies across Node versions (CI consistently reports
       // ~10-15% lower than local for module-wrapper and require() lines).
-      // The overall numbers reflect that dashboard.js and poller.js are large
-      // untested files; the security-critical files (auth, middleware, utils)
-      // are well-covered by the 115 tests.
+      // Thresholds updated after adding integration tests for dashboard.js,
+      // emby.js, sonarr.js, radarr.js, and sabnzbd.js.  The SSE /stream
+      // endpoint and poller.js remain untested so thresholds are set
+      // conservatively to avoid CI flap from V8 coverage variance.
       thresholds: {
-        lines: 22,
-        functions: 12,
-        branches: 8,
-        statements: 20
+        lines: 55,
+        functions: 55,
+        branches: 40,
+        statements: 55
       }
     }
   }