Add test coverage reporting

[DevOlabode]

Context

The API now has a real node --test suite (tests/api/, tests/unit/). Node's built-in test runner already supports coverage with no extra dependency:

node --test --experimental-test-coverage

Running that today gives ~59% overall line coverage, close to 100% on the routes actually exercised (controllers/api/*, models/*) and near-zero on paths tests don't hit yet (utils/mailer.js, most of utils/friendlyError.js's branch table, utils/passwordReset.js).

Goal

• Add an npm run test:coverage (or similar) script wrapping node --test --experimental-test-coverage.
• Record the current baseline (numbers above, or refreshed at PR time) somewhere a contributor will see it - docs/development.md is a reasonable place, alongside the existing "Tests" section.
• Do not add a coverage threshold that fails CI yet. That's a follow-up once coverage is trending in the right direction, not a day-one gate.
• Document how to run it locally, including how to read the per-file table.

Non-goals

• No new dependency - Node's built-in coverage is sufficient.
• No CI enforcement of a minimum percentage yet.

Relevant files

• package.json (scripts)
• docs/development.md (Tests section)
• .github/workflows/ci.yml - only if a non-blocking coverage report step turns out to be worth adding

Acceptance criteria

• A documented script produces a coverage report locally
• The current baseline is written down somewhere contributors will find it
• CI is not made to fail based on a coverage number