feat: Add code coverage reporting to GitHub Actions

[dgee2]

Summary

Add code coverage collection and reporting to the existing CI workflow in .github/workflows/main.yml for both the .NET backend and Vue/Vitest frontend.

Background

Both the backend test projects and the frontend already have coverage tooling installed:

• coverlet.collector in MenuApi.Tests.csproj and MenuApi.Integration.Tests.csproj
• @vitest/coverage-v8 in ui/menu-website/package.json

However, coverage is not currently collected or surfaced in CI.

Important: MTP Compatibility

The backend uses xunit.v3.mtp-v2 with Microsoft Testing Platform (MTP). The standard --collect:"XPlat Code Coverage" flag does not work with MTP. Instead:

• Add Microsoft.Testing.Extensions.CodeCoverage NuGet package to test projects
• Use dotnet test --coverage --coverage-output-format cobertura instead

Acceptance Criteria

• Backend unit tests (MenuApi.Tests) collect Cobertura coverage
• Backend integration tests (MenuApi.Integration.Tests) collect Cobertura coverage
• Frontend Vitest tests collect coverage (v8 provider, LCOV + json-summary output)
• Coverage summary is posted to the GitHub Actions Step Summary page
• Coverage summary is posted as a PR comment on pull requests
• No external services or additional secrets are required (self-contained)
• Coverage results do not break existing CI for unrelated failures

Options Considered

Option A: Artifacts-Only

Generate HTML reports and upload as GitHub Actions artifacts.

• Pros: No external services, fully free, full HTML line-by-line reports
• Cons: Must manually download to view, no PR visibility, no threshold enforcement

Option B: Step Summary + PR Comments (Recommended)

Use danielpalme/ReportGenerator-GitHub-Action and davelosert/vitest-coverage-report-action to post coverage summaries to the workflow Step Summary page and as PR comments.

• Pros: No external services or additional secrets; coverage visible on PRs and workflow run pages; can enforce minimum thresholds
• Cons: No persistent historical trend dashboard

Option C: Codecov

Upload Cobertura/LCOV files to Codecov SaaS for a full dashboard with history, trend charts, and inline PR line annotations.

• Pros: Best-in-class dashboard, historical trends, line-level PR annotations, coverage badges; free for single developer (250 private repo uploads/month)
• Cons: External service dependency, requires CODECOV_TOKEN secret, data leaves GitHub

Option D: Coveralls

Similar to Codecov but simpler; historically more popular for JS/Ruby.

• Pros: Free for public repos, simple setup with GITHUB_TOKEN
• Cons: Less polished UI, weaker .NET/Cobertura support, less active development

Implementation Notes (Option B)

• Add Microsoft.Testing.Extensions.CodeCoverage to backend test .csproj files
• Use danielpalme/ReportGenerator-GitHub-Action for .NET Cobertura to Markdown + $GITHUB_STEP_SUMMARY
• Use davelosert/vitest-coverage-report-action for Vitest LCOV to PR comment
• Add coverage section to vitest.config.ts (provider: 'v8', reporter: ['text', 'lcov', 'json-summary'])
• Add pull-requests: write permission to affected jobs
• Pin all third-party Actions to commit SHAs for supply-chain security