test(backend): add 55+ test files to push coverage to 98%

Subagents delivered tests across all uncovered backend modules:

Schemas (100%): agent, auth, health, profile, settings, validation
Services (98-100%): auth, profile, health, llm, mapping, resource,
  security, git, superset_lookup, sql_table_extractor, rbac
API routes (new): auth, admin, health, environments, plugins,
  dashboards (helpers, projection, actions, listing),
  git (config, deps, env, helpers)
Clean Release (100%): DTO, facade, policy_engine, stages,
  repos, preparation, source_isolation, compliance
Git services: base, remote_providers
Agent module: app, run, middleware, langgraph_setup
Core: trace, cleanup, ws_log_handler, timezone, auth (config/oauth/security), matching
Reports: normalizer, report_service, type_profiles
Notifications: service, providers

Also:
- .gitignore: add .coverage, *.cover, coverage-* dirs
- src/schemas/auth.py: fix AD group DN regex (comma in CN=...)
- Remove co-located src/services/__tests__/ (caused pytest module collision)

backend/tests/api/test_git_deps.py

@@ -0,0 +1,41 @@
+# #region Test.Api.GitDeps [C:2] [TYPE Module] [SEMANTICS test,git,deps]
+# @BRIEF Unit tests for git dependency helper.
+# @RELATION BINDS_TO -> [GitDeps]
+# @TEST_EDGE: monkeypatch_resolution
+
+import sys
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+_src = str(Path(__file__).resolve().parent.parent.parent / "src")
+if _src not in sys.path:
+    sys.path.insert(0, _src)
+
+
+class TestGetGitService:
+    """get_git_service resolves from sys.modules at call time."""
+
+    def test_get_git_service_resolves_correctly(self):
+        """Verify it resolves from sys.modules."""
+        import sys as sys_mod
+        from src.api.routes.git._deps import get_git_service
+        from src.api.routes import git as git_routes
+
+        mock_service = MagicMock()
+        # Monkeypatch via sys.modules
+        sys_mod.modules["src.api.routes.git"].git_service = mock_service
+
+        try:
+            result = get_git_service()
+            assert result is mock_service
+        finally:
+            # Restore
+            sys_mod.modules["src.api.routes.git"].git_service = git_routes.git_service
+
+    def test_max_repository_status_batch(self):
+        """Guard value is 50."""
+        from src.api.routes.git._deps import MAX_REPOSITORY_STATUS_BATCH
+        assert MAX_REPOSITORY_STATUS_BATCH == 50
+# #endregion Test.Api.GitDeps