PR #34 follow-ups: SonarCloud new-code coverage & duplication quality gate #591

Tracking issue for SonarCloud Quality Gate findings on PR #34 that are out of scope for the Epic 8 guided-inspection review-thread fixes (which are TypeScript-only).

Findings to resolve

1. 0% Coverage on New Code (required ≥ 80%). Per the ci-analyst diagnosis, sonar-project.properties sets sonar.go.coverage.reportPaths=apps/api/coverage.out, but .github/workflows/sonarcloud.yml has no step that generates that file — it goes straight from actions/checkout to the SonarCloud scan. SonarCloud therefore reads Go coverage as 0% and the new-code coverage condition fails.

   • Suggested fix: add a Go test + coverage step (e.g. cd apps/api && go test -coverprofile=coverage.out ./...) to sonarcloud.yml before the scan.

2. Duplication on New Code above 3% (reported 7.9%–10.5%). New-code duplication exceeds the quality-gate threshold. Audit the new mobile inspection code for extractable duplication (some was already consolidated into classification.ts in commit 4069dcc; more may remain).

These require CI-workflow and coverage changes that span apps/api and the SonarCloud workflow config, outside the scope of the two Copilot review threads addressed on the PR.