Enforce explicit test coverage thresholds in CI

TESTS.md

@@ -94,7 +94,12 @@ stateDiagram-v2
 - Security middleware tests validate response headers and rate-limiting behavior on auth/admin routes.
 - Frontend regression guard tests assert modal/admin JS no longer interpolate untrusted values in vulnerable patterns.
 
+## Coverage Policy
+- CI and local script enforce Cobertura thresholds from test coverage collection.
+- Minimum line coverage: 90%.
+- Minimum branch coverage: 70%.
+
 ## Execution Notes
 - Use named test data builders for players/suggestions to keep cases small and isolated.
 - Reset in-memory DB per test to avoid cross-contamination; assert timestamps using time providers or approximate windows.
-- Cover success + failure for every endpoint status path to reach 100% line/branch coverage.
+- Cover success + failure for endpoint status paths and critical helper branches to stay above enforced thresholds.