Add unit tests for untested edge cases and code paths

PayloadTest:
- decode() with invalid JSON, JSON array, null, boolean, number
- load() with all fields present but empty strings
- create() with invalid scope string (falls back to cookie)
- create() with missing json property (defaults to true)

DomainManagerTest:
- TLD table coverage: com.au, co.jp, com.br, co.nz, com.mx, co.in, br.com
- Single-label host matching behavior
- Empty string host
- validReturn with URL containing port, without path, different domain with port

MakeNonceTraitTest:
- Retry-then-succeed path (first attempt collides, second succeeds)
- Zero retries throws immediately on collision

StringTraitTest:
- Only invalid characters collapses to single underscore
- Exactly 128 characters boundary
- Multibyte characters (é, ö) replaced with underscore
- Emoji replaced with underscore

GetTotpTraitTest:
- HOTP URI triggers HttpException(500) via instanceof check

LoginManagerTest:
- ULID collision throws HttpException(500)
- Central auth cookie sets domain on matching host (uses auth cookie name)
- Central auth cookie uses null domain on non-matching host
- Empty return parameter falls back to request path

BackupCodeManagerTest:
- Empty string code returns false
- Code with value false (consumed) verified via cache state
- Generated codes are unique (50 codes)
- Code length equals TOTP digits + 2

MonitorCacheKeysTest:
- saveDeferred on __key_list and __chg_list throws OutOfBoundsException
- getKeys returns empty when key list is lost
- deleteItem/deleteItems return true assertions

PersistCacheTest:
- Mixed updates and removals in same persist cycle
- Multiple boot-modify-persist cycles with interleaved modifications

tests/Unit/Service/BackupCodeManagerTest.php

@@ -168,4 +168,48 @@ final class BackupCodeManagerTest extends TestCase {
             self::assertFalse($pool->hasItem('backup_' . strtolower($code)));
         }
     }
+
+    public function testVerifyAndConsumeEmptyStringReturnsFalse(): void {
+        $manager = $this->makeManager();
+
+        // empty string after preg_replace becomes 'backup_' with nothing after it
+        self::assertFalse($manager->verifyAndConsume(''));
+    }
+
+    public function testVerifyAndConsumeCodeWithValueFalseReturnsFalse(): void {
+        $pool = new ArrayAdapter();
+        $manager = $this->makeManager($pool);
+        $codes = $manager->generate(1);
+        $code = $codes[0];
+
+        // first use succeeds
+        self::assertTrue($manager->verifyAndConsume($code));
+
+        // the code is now marked as false (used); isHit is true but get() is false
+        $key = 'backup_' . strtolower($code);
+        $item = $pool->getItem($key);
+        self::assertTrue($item->isHit());
+        self::assertFalse($item->get());
+
+        // second use should fail because get() returns false
+        self::assertFalse($manager->verifyAndConsume($code));
+    }
+
+    public function testGenerateProducesUniqueCodes(): void {
+        $manager = $this->makeManager();
+
+        $codes = $manager->generate(50);
+
+        self::assertCount(50, $codes);
+        self::assertCount(50, array_unique($codes), 'All generated codes should be unique');
+    }
+
+    public function testGenerateCodeLengthIsDigitsPlusTwo(): void {
+        $manager = $this->makeManager();
+
+        $codes = $manager->generate(1);
+
+        // default TOTP digits is 6, so code length should be 6 + 2 = 8
+        self::assertSame(8, strlen($codes[0]));
+    }
 }