fix: post-M4 validation improvements

- Session: verify server-side iat expiry (not just cookie maxAge)
- Validate ProjectMemberRole on member add (reject arbitrary strings)
- Scope coverage threshold to Repository/Service layers (per guidelines)
- Add session expiry/fresh-token unit tests

vitest.config.ts

@@ -22,11 +22,14 @@ export default defineConfig({
     coverage: {
       provider: 'v8',
       reporter: ['text', 'json', 'html'],
+      include: ['repositories/**', 'services/**'],
       exclude: [
         'node_modules/**',
         'dist/**',
         '.next/**',
         '.steering/**',
+        'app/**',
+        'components/**',
         '**/*.config.{ts,js,mjs}',
         '**/types/**',
         'tests/**',