Add unit tests for untested edge cases and code paths

PayloadTest:
- decode() with invalid JSON, JSON array, null, boolean, number
- load() with all fields present but empty strings
- create() with invalid scope string (falls back to cookie)
- create() with missing json property (defaults to true)

DomainManagerTest:
- TLD table coverage: com.au, co.jp, com.br, co.nz, com.mx, co.in, br.com
- Single-label host matching behavior
- Empty string host
- validReturn with URL containing port, without path, different domain with port

MakeNonceTraitTest:
- Retry-then-succeed path (first attempt collides, second succeeds)
- Zero retries throws immediately on collision

StringTraitTest:
- Only invalid characters collapses to single underscore
- Exactly 128 characters boundary
- Multibyte characters (é, ö) replaced with underscore
- Emoji replaced with underscore

GetTotpTraitTest:
- HOTP URI triggers HttpException(500) via instanceof check

LoginManagerTest:
- ULID collision throws HttpException(500)
- Central auth cookie sets domain on matching host (uses auth cookie name)
- Central auth cookie uses null domain on non-matching host
- Empty return parameter falls back to request path

BackupCodeManagerTest:
- Empty string code returns false
- Code with value false (consumed) verified via cache state
- Generated codes are unique (50 codes)
- Code length equals TOTP digits + 2

MonitorCacheKeysTest:
- saveDeferred on __key_list and __chg_list throws OutOfBoundsException
- getKeys returns empty when key list is lost
- deleteItem/deleteItems return true assertions

PersistCacheTest:
- Mixed updates and removals in same persist cycle
- Multiple boot-modify-persist cycles with interleaved modifications

tests/Unit/MonitorCacheKeysTest.php

@@ -209,4 +209,65 @@ final class MonitorCacheKeysTest extends TestCase {
         $this->expectException(OutOfBoundsException::class);
         $monitor->deleteItems(['__chg_list']);
     }
+
+    public function testSaveDeferredOnKeyListThrowsOutOfBoundsException(): void {
+        $monitor = $this->wrap();
+        $item = $monitor->getItem('safe');
+        $item->set('value');
+
+        // getItem returns the real item, but saveDeferred calls update() which
+        // validates the key — so we need to get the __key_list item and try to save it
+        $keyListItem = $monitor->getItem('__key_list');
+
+        $this->expectException(OutOfBoundsException::class);
+        $monitor->saveDeferred($keyListItem);
+    }
+
+    public function testSaveDeferredOnChangeListThrowsOutOfBoundsException(): void {
+        $monitor = $this->wrap();
+        $changeListItem = $monitor->getItem('__chg_list');
+
+        $this->expectException(OutOfBoundsException::class);
+        $monitor->saveDeferred($changeListItem);
+    }
+
+    public function testGetKeysReturnsEmptyArrayWhenKeyListMissing(): void {
+        // If the underlying pool loses its key list, getKeys should return []
+        $pool = new ArrayAdapter();
+        $monitor = new MonitorCacheKeys($pool);
+
+        $item = $monitor->getItem('alpha');
+        $item->set('value');
+        $monitor->save($item);
+
+        // delete the key list directly from the underlying pool
+        $pool->deleteItem('__key_list');
+
+        $monitor2 = new MonitorCacheKeys($pool);
+        // the constructor will re-initialize since __key_list is missing
+        // but getKeys on the new monitor should be empty
+        self::assertSame([], $monitor2->getKeys());
+    }
+
+    public function testDeleteItemReturnsTrueForExistingKey(): void {
+        $monitor = $this->wrap();
+        $item = $monitor->getItem('to-delete');
+        $item->set('value');
+        $monitor->save($item);
+
+        self::assertTrue($monitor->deleteItem('to-delete'));
+        self::assertNotContains('to-delete', $monitor->getKeys());
+    }
+
+    public function testDeleteItemsReturnsTrue(): void {
+        $monitor = $this->wrap();
+        foreach (['a', 'b', 'c'] as $key) {
+            $item = $monitor->getItem($key);
+            $item->set('value');
+            $monitor->save($item);
+        }
+
+        self::assertTrue($monitor->deleteItems(['a', 'b', 'c']));
+        self::assertSame([], $monitor->getKeys());
+    }
 }