test: cover read-only PHP controllers

[erseco]

Summary

• add minimal HTTP/session response stubs to the standalone PHPUnit bootstrap
• cover AssetController authentication, session validation, path safety, lookup errors, MIME detection, and security headers
• cover PackageController authentication, invalid paths, lookup errors, streaming, and response headers
• cover ThumbnailController authentication, lookup errors, missing screenshots, and PNG responses
• include only these three controller files in the backend Clover scope
• keep the 90% backend threshold

Stack

Depends on #119.

1. test: extend PHP coverage to app and preview #119 — AppInfo + Preview
2. this PR — read-only controllers
3. next — static/page controllers
4. final — EditorController / extracted editor logic

Validation

• CI: green
• Playground preview: green
• backend coverage: 93.84%
• AssetController: 100% lines
• PackageController: 100% lines
• ThumbnailController: 100% lines

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.97%. Comparing base (43a1605) to head (2d7ac4b).

Additional details and impacted files

@@                         Coverage Diff                         @@
##             test/coverage-appinfo-preview     #120      +/-   ##
===================================================================
+ Coverage                            93.71%   94.97%   +1.26%     
- Complexity                              65       94      +29     
===================================================================
  Files                                   13       16       +3     
  Lines                                  350      438      +88     
  Branches                                54       54              
===================================================================
+ Hits                                   328      416      +88     
  Misses                                  15       15              
  Partials                                 7        7              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Preview this PR in the Nextcloud Playground

A fresh Nextcloud boots in your browser with this branch's exelearning app installed and enabled (log in as admin / admin). Two sample .elpx are seeded under exelearning-samples/ in Files — click one to open the viewer.

eXeLearning editor: v4.0.5 (overlaid at boot from the upstream release).