test(backend): raise coverage to 95%+ statements and branches (97.8%/95.0%)

- ~60 new/extended test files across api, core, plugins, services, schemas:
  routes, superset clients, task_manager, lineage, git, translate,
  dashboard-testing, load-testing, migration, llm_analysis, scheduler, ssl
- .coveragerc: enable branch coverage; exclude src/__tests__ (test files)
  and src/scripts (CLI/ops tools) from the denominator
- bug fixes found while testing:
  * settings: PUT /settings/reports registered under duplicated prefix
  * schemas/lineage: FleetReportDTO missing run_status (route always 500)
  * dashboard_testing/baseline_inheritance: visual entry read wrong field
  * superset_client/_databases: logger extra name shadowed LogRecord attr
  * routes/datasets: _yaml_string_paths recursion without yield from
  * translate/sql_generator: restore explicit-type timestamp contract
  * baseline_catalog: remove unreachable dashboard_id fallback
- conftest fixes: pytest_plugins to rootdir conftest (pytest 9), test
  filename collision, TMPDIR-safe integration fixtures

backend/tests/test_app_ws_endpoint.py

@@ -69,6 +69,21 @@ class TestWebSocketEndpointFull:
         ws.close.assert_called_once_with(code=4001, reason="Authentication required")
     # #endregion Test.AppModule.TestAuthRejectedCloses
 
+    # #region Test.AppModule.TestPermissionRejectedCloses [C:2] [TYPE Function]
+    @pytest.mark.asyncio
+    async def test_permission_rejected_closes(self):
+        from src.app import websocket_endpoint
+        ws = MagicMock(); ws.query_params = {"token": "valid"}
+        ws.close = AsyncMock(); ws.accept = AsyncMock()
+        with (
+            patch("src.app._authenticate_websocket", return_value=True),
+            patch("src.app._authorize_websocket", return_value=False),
+        ):
+            await websocket_endpoint(ws, "task-1")
+        ws.accept.assert_called_once()
+        ws.close.assert_called_once_with(code=4003, reason="Insufficient permissions")
+    # #endregion Test.AppModule.TestPermissionRejectedCloses
+
     # #region Test.AppModule.TestAcceptsAndSendsInitialStatus [C:2] [TYPE Function]
     @pytest.mark.asyncio
     async def test_accepts_and_sends_initial_status(self):