fix(tests): resolve all phpunit failures — clean-DB suite green (#4626) (#4691)

* fix(tests): resolve all phpunit failures (#4626)

Bring the phpunit suite from 153 failures to 0 (281 tests passing):

- Employee: decouple grants block from save_value success; restructure
  save_employee new-employee + disallowed-grants early return
- Sale: unify sales_payments_temp schema (add sale_cash_refund,
  reference_code) so both creators produce an identical superset table
- Employees controller: provide placeholder password/hash in testing env
  so new-employee insert succeeds and grant logic is testable
- TestDatabaseBootstrapSeeder: reset shared connection table-name cache
  after bootstrap reset to avoid stale listTables()/tableExists() results
- Config: fix postSaveLocale validation rule syntax
- Test data: use unique employee usernames to avoid UNIQUE constraint
  collisions latching strict-mode transStatus=false on the shared conn
- Various test-file and language-string corrections

* test: consolidate employee fixtures in shared trait

Route test employee creation through a single EmployeeFixtureTrait
that delegates to Employee::save_employee(), so fixtures exercise the
same production code path instead of raw DB inserts. Removes six
near-duplicate helpers across EmployeeTest, SalesControllerTest, and
EmployeesControllerTest while preserving each test's specific grant
set.

Closes a piece of the fixture-scattering flagged in #4626.

Closes #4626

* test: add global DROP/CREATE grant and commit theme fixtures

* fix(ci): remove redundant symlink step, set working encryption key

* fix(ci): run phpunit with --no-coverage to avoid no-driver warning

* fix: address code review findings

- Config: restore strict locale validation (min required|integer|>0) and
  fix max cross-field check with a new gte_field rule (CI4's
  greater_than_equal_to[field] does not resolve the field value)
- Tests: assert rejection for non-numeric/zero/negative/min>max limits
- .env.example: remove shared hard-coded encryption.key (auto-generates);
  document Docker env-var usage
- phpunit.yml: scope CREATE/DROP grant to ospos_test.* and provision a
  per-run encryption key as an env var

* feat: support ENCRYPTION_KEY env var for encryption key

Read ENCRYPTION_KEY as a fallback for the encryption key when the
config value is empty. This is a supported, reliable path for Docker /
container deploys and CI, avoiding reliance on the raw dotted
encryption.key env var.

* fix: align Summary_report temp tables with Sale temp table schema

Summary_report created sales_items_taxes_temp and sales_payments_temp with fewer columns than the canonical create_temp_table() in Sale.php. A later reader expecting those columns hit a schema-mismatch SQL error on the shared temp tables. Add internal_tax/sales_tax (sales_items_taxes_temp) and reference_code (sales_payments_temp) so all creators emit the identical column set.

.github/workflows/phpunit.yml

@@ -71,8 +71,8 @@ jobs:
       - name: Start MariaDB
         run: |
           docker run -d --name mysql \
-            -e MYSQL_ROOT_PASSWORD=root \
-            -e MYSQL_DATABASE=ospos \
+             -e MYSQL_ROOT_PASSWORD=root \
+             -e MYSQL_DATABASE=ospos_test \
             -e MYSQL_USER=admin \
             -e MYSQL_PASSWORD=pointofsale \
             -p 3306:3306 \
@@ -84,6 +84,13 @@ jobs:
           done
           echo "MariaDB is ready!"
 
+          # Grant admin the CREATE/DROP privileges it needs to drop and
+          # recreate the test database at the start of each test class.
+          # Scoped to ospos_test only — never global *.* — so a compromised
+          # test process cannot alter or drop unrelated schemas.
+          docker exec mysql mysql -u root -proot \
+            --execute="GRANT CREATE, DROP ON ospos_test.* TO 'admin'@'%'; FLUSH PRIVILEGES;"
+
       - name: Get composer cache directory
         run: echo "COMPOSER_CACHE_FILES_DIR=$(composer config cache-files-dir)" >> $GITHUB_ENV
 
@@ -102,11 +109,20 @@ jobs:
       - name: Create .env file
         run: cp .env.example .env
 
+      - name: Provision per-run encryption key
+        # Generates a unique key for this run and exports it as a real OS env
+        # var (ENCRYPTION_KEY), which the app's Encryption config reads as a
+        # fallback after the normal .env lookup. This is supported explicitly,
+        # so no shared key is committed or shipped.
+        run: |
+          KEY=$(openssl rand -hex 32)
+          printf 'ENCRYPTION_KEY=%s\n' "$KEY" >> "$GITHUB_ENV"
+
       - name: Run PHPUnit tests
         env:
           CI_ENVIRONMENT: testing
           MYSQL_HOST_NAME: 127.0.0.1
-        run: composer test -- --log-junit test-results/junit.xml
+        run: composer test -- --no-coverage --log-junit test-results/junit.xml
 
       - name: Upload test results
         uses: actions/upload-artifact@v4