test(coverage/crypto): drive crypto to ≥95% (was 89.2%)

[mastermanas805]

Summary

Drives common/crypto line coverage from 89.2% → 95.5% by adding 8 internal tests targeting previously-uncovered error branches in aes.go, jwt.go, and token.go.

Test additions (crypto/coverage_test.go, internal package)

• Encrypt nonce-read error path — randReader swap with errReader
• GenerateAPIKey rand-read error + short-read paths — tokenRandReader swap
• SignJWT + SignOnboardingJWT SignedString error paths — jwtSigningMethod swap with failingSigningMethod
• VerifyOnboardingJWT alg-confusion guard (RS256 header rejected)
• VerifyJWT + VerifyOnboardingJWT defensive iat-future check — uses jwt.TimeFunc override so the library's RegisteredClaims.Valid passes, leaving our defensive check to fire (guards against jwt/v4 upstream dropping the iat check)

Source-side change

Three package-level vars replace direct references:

• var randReader io.Reader = rand.Reader (aes.go)
• var tokenRandReader io.Reader = rand.Reader (token.go)
• var jwtSigningMethod jwt.SigningMethod = jwt.SigningMethodHS256 (jwt.go)

Production behaviour unchanged; only tests override them.

Remaining uncovered (5 stmts — genuinely unreachable)

• aes.go:61-63 / 87-89 cipher.NewGCM error — AES blocks never fail GCM construction
• jwt.go:83 non-ValidationError unwrap — jwt/v4 always wraps parse errors in *ValidationError
• jwt.go:86-88 / 130-132 !ok || !parsed.Valid defensive — ParseWithClaims with a typed receiver either errors or returns ok && Valid

Test plan

• go test ./crypto -count=1 -race passes
• go vet ./crypto/ clean
• go test ./... -count=1 -short (whole common module) passes
• Coverage: go test ./crypto -coverprofile=cov.out → 95.5%

🤖 Generated with Claude Code