kit: CI coverage gate excludes convex verifiers — all four store lanes unmeasured

[hyochan]

Third issue from the internal per-store lane audit (see #310, #311).

packages/kit's coverage gate measures only the HTTP shell: test:coverage passes --coverage.include='server/**/*.ts' and deploy-kit.yml enforces 90% line coverage on that lcov. The convex/ tree — where the actual per-store verification logic lives — is entirely outside the measured and enforced set.

Measured per-file statement coverage for the verifiers (vitest v8, full suite green at 1088 tests):

File	Stmts	Branch
convex/purchases/android.ts	54.5%	—
convex/purchases/amazon.ts	23.2%	18.9%
convex/purchases/ios.ts	8.1%	10.4%
convex/purchases/horizon.ts	9.5%	0.0%

The server/api/v1 layer sits at 88–93% and passes the gate while the verify-action bodies (upstream HTTP call, status-code mapping, persistence) are dead-reckoned.

Suggested steps:

• Add convex/**/*.ts to the coverage include set (excluding _generated)
• Set a realistic initial threshold for the convex component and ratchet up, rather than blocking on 90% immediately
• Add fetch-stubbed action suites for amazon.ts and horizon.ts (status ladders, retry/timeout, failure persistence) — concrete gaps listed in kit: Horizon subscription lane is structurally broken and can corrupt Google Play subscriptions #310/kit: harden the Amazon RVS lane — sandbox bypass, expiry assumption, state staleness #311
• Route-level tests asserting route→Convex argument forwarding for apple, horizon, and amazon (google already has this pattern at routes.test.ts:88-95)

🤖 Findings from an internal multi-agent audit.

[hyochan]

Resolved by #313.\n\nKit now collects server and Convex coverage in one Vitest run while enforcing truthful path-scoped gates separately: server remains at 90%, and Convex starts at 48% for ratcheting. Codecov receives one iapkit report/flag, with path-scoped project, patch, and component statuses so the combined report is not misreported as either component.\n\nThe final integrated coverage run passed 86 test files / 1,178 tests with server line coverage at 90.04% (1,229 / 1,365) and Convex at 52.13% (3,365 / 6,455). Amazon and Horizon action bodies plus Apple, Horizon, and Amazon route forwarding are directly exercised. The repository parity audit enforces this two-component, one-upload contract, including normalized parent-directory handling for scoped LCOV paths.\n\nThis issue's change is limited to IAPKit coverage and CI; the SDK contract work carried by the same PR resolves #311 separately.