Add unit tests for untested edge cases and code paths

PayloadTest:
- decode() with invalid JSON, JSON array, null, boolean, number
- load() with all fields present but empty strings
- create() with invalid scope string (falls back to cookie)
- create() with missing json property (defaults to true)

DomainManagerTest:
- TLD table coverage: com.au, co.jp, com.br, co.nz, com.mx, co.in, br.com
- Single-label host matching behavior
- Empty string host
- validReturn with URL containing port, without path, different domain with port

MakeNonceTraitTest:
- Retry-then-succeed path (first attempt collides, second succeeds)
- Zero retries throws immediately on collision

StringTraitTest:
- Only invalid characters collapses to single underscore
- Exactly 128 characters boundary
- Multibyte characters (é, ö) replaced with underscore
- Emoji replaced with underscore

GetTotpTraitTest:
- HOTP URI triggers HttpException(500) via instanceof check

LoginManagerTest:
- ULID collision throws HttpException(500)
- Central auth cookie sets domain on matching host (uses auth cookie name)
- Central auth cookie uses null domain on non-matching host
- Empty return parameter falls back to request path

BackupCodeManagerTest:
- Empty string code returns false
- Code with value false (consumed) verified via cache state
- Generated codes are unique (50 codes)
- Code length equals TOTP digits + 2

MonitorCacheKeysTest:
- saveDeferred on __key_list and __chg_list throws OutOfBoundsException
- getKeys returns empty when key list is lost
- deleteItem/deleteItems return true assertions

PersistCacheTest:
- Mixed updates and removals in same persist cycle
- Multiple boot-modify-persist cycles with interleaved modifications

tests/Unit/Trait/StringTraitTest.php

@@ -28,4 +28,33 @@ final class StringTraitTest extends TestCase {
     public function testMakeCacheKeyEmptyString(): void {
         self::assertSame('', $this->makeCacheKey(''));
     }
+
+    public function testMakeCacheKeyWithOnlyInvalidChars(): void {
+        // preg_replace with + collapses consecutive invalid chars into one _
+        self::assertSame('_', $this->makeCacheKey('!!!'));
+        self::assertSame('_', $this->makeCacheKey('   '));
+        self::assertSame('_', $this->makeCacheKey('!@#'));
+        self::assertSame('_', $this->makeCacheKey('!@ #'));
+    }
+
+    public function testMakeCacheKeyTruncatesToExactly128(): void {
+        $input = str_repeat('a', 128);
+        self::assertSame(128, mb_strlen($this->makeCacheKey($input)));
+        self::assertSame($input, $this->makeCacheKey($input));
+
+        $input129 = str_repeat('a', 129);
+        self::assertSame(128, mb_strlen($this->makeCacheKey($input129)));
+    }
+
+    public function testMakeCacheKeyWithMultibyteChars(): void {
+        // multibyte chars are replaced with a single underscore
+        $result = $this->makeCacheKey('héllo wörld');
+        // é and ö are not in [A-Za-z0-9_.] so they become _
+        self::assertSame('h_llo_w_rld', $result);
+    }
+
+    public function testMakeCacheKeyWithEmoji(): void {
+        $result = $this->makeCacheKey('a🎉b');
+        self::assertSame('a_b', $result);
+    }
 }