Run PHPStan level 10 over tests/

[lisachenko]

Motivation

phpstan.neon analyzes only src/ (paths: [src]), leaving 67 test files plus fixtures/stubs entirely outside level-10 analysis — test and fixture code can rot freely while src/ is held to the strictest standard.

Proposed change

• Add tests to paths (evaluate excluding heavyweight generated fixtures under tests/Fixtures/ if the signal-to-noise is bad).
• Add phpstan/phpstan-phpunit (+ phpstan/extension-installer, with the corresponding allow-plugins entry) for assertion type narrowing.
• Keep new suppressions in a separate phpstan-baseline-tests.php so the pristine 3-entry src baseline stays clean; burn down what's cheap to fix immediately instead of baselining it.

Acceptance criteria

• composer analyze / CI phpstan job covers tests at level 10 and is green.
• src baseline unchanged (or smaller).