test: lift coverage 41% → 76% (+1068 tests across 36 files)

Service-level tests now exercise provider, permissions, project, journal,
messaging, work_session, metrics, kanban, extraction, learning, notification,
dashboard, llm_routing, a2a, task, repository_base, audit, db_seed,
branch_name, indexed_document, query_helpers, agent. API route tests cover
provider, journal, project, sessions, dashboard, work_session, tasks, a2a,
groups, notifications, agents, channels, messages, kanban, api_resources.
Pure-function helpers covered: handlers, deps_helpers, middleware,
middleware_docs, transcription, pr templates, agents_config, errors,
logging, journal/notification/channel/a2a access, task_lifecycle,
streaming, converters, crypto, schemas (common + websocket), events,
permissions extras.

pyproject ruff per-file-ignores extended for tests so PLR2004 (status code
magic values), PLC0415 (lazy imports), PLR0913 (fixture params), ARG001
(unused fixture deps), SIM105, and E501 don't fight test idioms.

tests/unit/utils/test_crypto.py

@@ -0,0 +1,53 @@
+"""utils.crypto coverage — Fernet encrypt/decrypt round-trip."""
+
+from __future__ import annotations
+
+import pytest
+from roboco.utils.crypto import (
+    EncryptionError,
+    decrypt_token,
+    encrypt_token,
+    is_encryption_configured,
+)
+
+
+def test_encrypt_decrypt_round_trip() -> None:
+    plaintext = "sk-secret-test-token-12345"
+    encrypted = encrypt_token(plaintext)
+    assert encrypted != plaintext
+    decrypted = decrypt_token(encrypted)
+    assert decrypted == plaintext
+
+
+def test_encrypt_empty_string_raises() -> None:
+    with pytest.raises(EncryptionError, match="empty"):
+        encrypt_token("")
+
+
+def test_decrypt_empty_string_raises() -> None:
+    with pytest.raises(EncryptionError, match="empty"):
+        decrypt_token("")
+
+
+def test_decrypt_invalid_token_raises() -> None:
+    with pytest.raises(EncryptionError):
+        decrypt_token("not-a-valid-token-at-all")
+
+
+def test_is_encryption_configured() -> None:
+    """Encryption must be configured for tests to run."""
+    assert is_encryption_configured() is True
+
+
+def test_encrypt_long_string() -> None:
+    plaintext = "a" * 1000
+    encrypted = encrypt_token(plaintext)
+    decrypted = decrypt_token(encrypted)
+    assert decrypted == plaintext
+
+
+def test_encrypt_unicode() -> None:
+    plaintext = "héllo wörld 中文 🚀"
+    encrypted = encrypt_token(plaintext)
+    decrypted = decrypt_token(encrypted)
+    assert decrypted == plaintext