test: add comprehensive test coverage for useToastStore, recipient PII reveal, session, and StepFinalSignature

[EmmanuelOchaje]

Summary

This PR adds comprehensive test coverage for four previously untested modules (#1900–#1903):

• [test] useToastStore has no dedicated test; duration defaults, truncation, and update-recompute logic are unverified #1900: useToastStore — duration defaults, truncation, and update-recompute logic
• [test] Recipient PII reveal route has zero test coverage of any branch #1901: Recipient PII reveal route — all branches including auth, roles, validation
• [test] session.ts has no test coverage for JWT expiry checking, session clearing, or logout debounce #1902: session.ts — JWT expiry checking, session clearing, logout debounce
• [test] StepFinalSignature's interest calculation and sign/submit/poll state machine have no test coverage #1903: StepFinalSignature — interest calculation and sign/submit/poll state machine

Test Files Added

1. useToastStore.test.ts (#1900)

Coverage:

• Duration defaults: 5000ms for success, 10000ms for error
• Custom duration respected when provided
• Toast truncation at MAX_STORED_TOASTS (20)
• Unique ID generation
• Update recomputes duration only when type changes (no explicit duration provided)
• Duration preserved during updates when explicitly set
• Toast prepending and filtering logic

Tests: 17 cases

2. reveal.route.test.ts (#1901)

Coverage:

• 401 Unauthorized: missing session token
• 401 Unauthorized: failed session validation
• 403 Forbidden: insufficient role (non-admin/operator)
• 400 Bad Request: missing field or reason
• 200 Success: authorized admin reveals email
• 200 Success: authorized operator reveals phone
• 200 Success: authorized admin reveals name
• Request ID generation and passing to backend
• Actor role included in backend request
• Backend decryption failure (500)

Tests: 10 cases covering all route branches

3. session.test.ts (#1902)

Coverage:

• JWT expiry detection: tokens with exp 1 hour in future, 1 hour past, at boundary
• JWT expiry edge cases: malformed tokens, missing payload, invalid base64, missing exp
• Base64url padding handling
• clearSessionState: user store cleared, wallet disconnected, storage keys removed
• logoutUser: clears state before redirect
• logoutUser debounce: prevents multiple redirects within same tick
• logoutUser reason handling (manual vs expired)
• SessionExpiredError: correct name, default/custom messages

Tests: 16 cases covering JWT expiry checking, session clearing, and logout debounce

4. StepFinalSignature.test.tsx (#1903)

Coverage:

• Interest calculation: 12% APR formula (principal * 12 * termDays) / (365 * 100)
• Total repayment: principal + interest
• Due date calculation: current date + term days
• Zero-day term handling
• State machine: idle → signing → submitting → polling
• Error states: missing contract ID, zero/negative principal, XDR build failures
• State transitions and cleanup on unmount
• Polling cancellation
• Currency formatting (USD)

Tests: 15 cases covering all branches and state transitions

Key Testing Patterns

1. Zustand store testing — Direct state access via getState(), state reset in beforeEach
2. API route testing — Mock cookies and fetch, verify headers and request bodies
3. Utility function testing — Edge cases, boundary conditions, malformed input
4. Component testing — State machine transitions, async operations, cleanup

Total Coverage

58 test cases across 4 test files, covering previously untested:

• Default behavior and edge cases
• All error branches
• State transitions and cleanup logic
• Boundary conditions and malformed input

Closes #1900
Closes #1901
Closes #1902
Closes #1903