test: enforce per-directory coverage thresholds

entities + use-cases + controllers must hit 100% (95% branches).
Project-wide baseline remains 80/75/80/80. Tightening these directories
reflects the architectural intent: these are the pure-logic layers and
should be exhaustively tested.

Added @vitest/coverage-v8@^3 to core-typescript, auth, blog,
marketing-pages, and navigation devDependencies.

Excluded from coverage (legitimately untestable):
- src/di/bind-production.ts — InversifyJS startup bootstrap
- src/application/repositories/** — pure TypeScript interfaces
- src/application/services/** — pure TypeScript interfaces (auth)
- src/integrations/cms/** — declarative Payload CMS config
- src/entities/cookie.ts — pure type aliases (auth)
- src/ui/** — React Query helpers, integration-tested in apps

Tests added (6 new files / 1 extended):
- auth/src/entities/errors.test.ts — UnauthenticatedError, UnauthorizedError,
  AuthenticationError, InputParseError constructors
- blog/src/entities/errors.test.ts — ArticleNotFoundError (default + custom
  message), InputParseError
- marketing-pages/src/entities/errors.test.ts — PageNotFoundError, InputParseError
- marketing-pages/src/entities/site-settings.test.ts — siteSettingsSchema
  (valid, no description, empty name rejection)
- navigation/src/entities/header.test.ts — headerItemSchema and headerSchema
  validation paths
- navigation/src/.../payload-header.repository.test.ts — logo relation-object,
  scalar-id, null, and null-item-field branches for full branch coverage

Spec: §6.9

packages/auth/vitest.config.ts

@@ -3,6 +3,47 @@ import { mergeConfig } from "vitest/config";
 import { nodeVitestConfig } from "@repo/core-typescript/vitest.base.node";
 
 export default mergeConfig(nodeVitestConfig, {
+  test: {
+    coverage: {
+      exclude: [
+        // DI bootstrap — wires InversifyJS at app startup; not unit-testable
+        "src/di/bind-production.ts",
+        // Pure TypeScript interface files — not executable
+        "src/application/repositories/**",
+        "src/application/services/**",
+        // Payload CMS collection config — declarative data, tested via Payload integration
+        "src/integrations/cms/**",
+        // Pure type-alias file — no executable code
+        "src/entities/cookie.ts",
+        // React Query option builders — integration-tested in apps
+        "src/ui/**",
+      ],
+      thresholds: {
+        "src/entities/**": {
+          statements: 100,
+          branches: 100,
+          functions: 100,
+          lines: 100,
+        },
+        "src/application/use-cases/**": {
+          statements: 100,
+          branches: 95,
+          functions: 100,
+          lines: 100,
+        },
+        "src/interface-adapters/controllers/**": {
+          statements: 100,
+          branches: 95,
+          functions: 100,
+          lines: 100,
+        },
+        statements: 80,
+        branches: 75,
+        functions: 80,
+        lines: 80,
+      },
+    },
+  },
   resolve: {
     alias: { "@": path.resolve(__dirname, "./src") },
   },