test: expand security audit edge-case coverage

[man4ish]

Summary

Adds 20 deterministic, security-focused edge-case tests for the audit service without modifying production source files.

Baseline

• 293 tests collected
• 85.30% statement/line coverage
• The complete repository suite could not finish because route/integration tests hit an existing hang.

Final hermetic result

• 266 passed
• 0 failed
• 0 skipped
• 38 existing SQLite/resource warnings

The deterministic suite excludes the hanging route/integration modules and backend integration tests requiring unavailable infrastructure. This PR does not claim that the entire repository suite passed.

Coverage

• Statements: 97.50% (506/517)
• Lines: 97.50% (506/517)
• Branches: 95.12% (78/82)

No coverage exclusions or pragmas were added, and tests were not weakened.

Covered security behavior

• HMAC signing input validation
• Malformed signature and wire-value handling
• Fail-closed behavior when digest comparison raises
• Audit-event schema validation
• ORM serialization and nullable identity metadata
• Audit route registration
• Security-filter forwarding and pagination
• Database-session cleanup on success and consumer exceptions

Production source protection

Production source files modified: 0.

Only tests/test_security_edge_cases.py is included. No generated artifacts, coverage reports, caches, or unrelated changes are included.

Known limitations

• Route/integration tests remain blocked by the existing hang.
• Worker integration tests require unavailable infrastructure.
• No Docker, live database, network service, credentials, or external IAM were required for the hermetic suite.

Discovered production issue

worker/main.py accesses fields["data"] before its exception handler. A malformed Redis message missing data can raise KeyError outside the documented failure-handling path.

This issue is documented only and intentionally NOT fixed in this PR. It should be handled separately as a production bug-fix PR.

Final verdict

PASS WITH CONDITIONS: meaningful security-focused coverage exceeds the statement/line and branch targets, while the full repository suite remains limited by existing hangs and unavailable infrastructure.