Add unit tests for untested edge cases and code paths

PayloadTest:
- decode() with invalid JSON, JSON array, null, boolean, number
- load() with all fields present but empty strings
- create() with invalid scope string (falls back to cookie)
- create() with missing json property (defaults to true)

DomainManagerTest:
- TLD table coverage: com.au, co.jp, com.br, co.nz, com.mx, co.in, br.com
- Single-label host matching behavior
- Empty string host
- validReturn with URL containing port, without path, different domain with port

MakeNonceTraitTest:
- Retry-then-succeed path (first attempt collides, second succeeds)
- Zero retries throws immediately on collision

StringTraitTest:
- Only invalid characters collapses to single underscore
- Exactly 128 characters boundary
- Multibyte characters (é, ö) replaced with underscore
- Emoji replaced with underscore

GetTotpTraitTest:
- HOTP URI triggers HttpException(500) via instanceof check

LoginManagerTest:
- ULID collision throws HttpException(500)
- Central auth cookie sets domain on matching host (uses auth cookie name)
- Central auth cookie uses null domain on non-matching host
- Empty return parameter falls back to request path

BackupCodeManagerTest:
- Empty string code returns false
- Code with value false (consumed) verified via cache state
- Generated codes are unique (50 codes)
- Code length equals TOTP digits + 2

MonitorCacheKeysTest:
- saveDeferred on __key_list and __chg_list throws OutOfBoundsException
- getKeys returns empty when key list is lost
- deleteItem/deleteItems return true assertions

PersistCacheTest:
- Mixed updates and removals in same persist cycle
- Multiple boot-modify-persist cycles with interleaved modifications

tests/Unit/Data/PayloadTest.php

@@ -36,6 +36,28 @@ final class PayloadTest extends TestCase {
         self::assertNull(Payload::decode(self::b64u('"just a string"')));
     }
 
+    public function testDecodeInvalidJsonReturnsNull(): void {
+        // valid base64url but invalid JSON
+        self::assertNull(Payload::decode(self::b64u('{invalid json')));
+    }
+
+    public function testDecodeJsonArrayReturnsNull(): void {
+        self::assertNull(Payload::decode(self::b64u('[1,2,3]')));
+    }
+
+    public function testDecodeJsonNullReturnsNull(): void {
+        self::assertNull(Payload::decode(self::b64u('null')));
+    }
+
+    public function testDecodeJsonBooleanReturnsNull(): void {
+        self::assertNull(Payload::decode(self::b64u('true')));
+        self::assertNull(Payload::decode(self::b64u('false')));
+    }
+
+    public function testDecodeJsonNumberReturnsNull(): void {
+        self::assertNull(Payload::decode(self::b64u('42')));
+    }
+
     public function testDecodeEmptyStringReturnsNull(): void {
         self::assertNull(Payload::decode(''));
     }
@@ -69,6 +91,12 @@ final class PayloadTest extends TestCase {
         self::assertNull(Payload::load($input));
     }
 
+    public function testLoadWithAllFieldsPresentButEmptyReturnsNull(): void {
+        // has() returns true for all, but create() rejects empty values
+        $input = new InputBag(['username' => '', 'nonce' => '', 'totp' => '']);
+        self::assertNull(Payload::load($input));
+    }
+
     public function testCreateWithValidData(): void {
         $data = (object)[
             'id' => 'user1', 'token' => 'tok1', 'nonce' => 'non1',
@@ -90,6 +118,21 @@ final class PayloadTest extends TestCase {
         self::assertSame(Scope::Cookie, $payload->scope);
     }
 
+    public function testCreateWithInvalidScopeFallsBackToCookie(): void {
+        $data = (object)[
+            'id' => 'user1', 'token' => 'tok1', 'nonce' => 'non1',
+            'scope' => 'admin',
+        ];
+        $payload = Payload::create($data);
+        self::assertSame(Scope::Cookie, $payload->scope);
+    }
+
+    public function testCreateWithMissingJsonDefaultsToTrue(): void {
+        $data = (object)['id' => 'user1', 'token' => 'tok1', 'nonce' => 'non1'];
+        $payload = Payload::create($data);
+        self::assertTrue($payload->json);
+    }
+
     public function testCreateWithNoneScopeSetsJsonFalse(): void {
         $data = (object)[
             'id' => 'user1', 'token' => 'tok1', 'nonce' => 'non1',