Add 60 unit tests for modules with least coverage

[devin-ai-integration]

Summary

The existing test suite had 8 tests covering sanitizeState, computeAuthSignature, extractEmailFromIdToken, a mocked primeAccount, ensureCurrentCodexLinked matching, and one resolveUsageUrl case. Several core modules had zero or near-zero test coverage.

This PR adds 60 new unit tests (8 → 68 total, 149 expect() calls) targeting the least-covered areas:

SessionService (21 new tests)

• extractAuthTokens — ChatGPT tokens, API key path, missing token throw, optional field defaults, API key precedence over tokens block
• validateChatGptAuth — valid chatgpt/api_key/null modes pass; empty token and unexpected mode throw
• resolveCodexExecutable — env var resolution (KEYFLOW_CODEX_PATH, KFL_CODEX_PATH), PATH search, fallback to "codex"
• extractEmailFromIdToken (extended) — preferred_username fallback, no-email payload, non-email value, base64url padding
• pruneBackups — keeps 10 newest, no-op for ≤10, no-throw on missing dir

UsageService (12 new tests)

• buildEmptyUsageSnapshot — all fields are null/'never'
• resolveUsageUrl — no config default, chat.openai.com → /backend-api, custom non-ChatGPT base → /api/codex/usage, trailing slash stripping, pre-existing /backend-api
• scanLogFile — valid log parsing (source/plan/windows/timestamps), email filtering, empty-file null, missing-file null, last-entry-wins, percentage clamping

ProfileService (22 new tests)

• buildEmptyState, getActiveAccount (null/match/fallback), resolveAccountByIdentifier (by id/label/unknown/duplicate), formatStateSummary (active flags, empty state)
• sanitizeState edge cases — non-object input, generated id, default label, percentage clamping, remainingPercent derivation, activeAccountId fallback/auto-set, invalid status default, source handling
• computeAuthSignature edge cases — different auth modes produce different sigs, no stable identity falls back to accessToken seed

kfl-bridge (5 new tests)

• buildBridgeStatusPayload — empty state, isActive/canSwitch/needsAttention flags, isBlocked for deactivated accounts, displayName email-vs-label fallback

Link to Devin session: https://app.devin.ai/sessions/72c3dfb1736048ad8b92da2b8a550854
Requested by: @hbui290

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring