test(coverage): cover the diff for ported auth + dsr changes

Close the cover-the-diff (L1, ADR-020) gaps the port opened:

- auth router: exercise the signUp/signOut procedure handlers through the
  container-resolved caller (reformatted onto new lines by the port).
- core-dsr export: add an audit-doc case with array-valued changedFields /
  piiCategories and an absent actorRoles, covering the optional-field
  branches of the new audit-trail mapper.
- coverage:diff excludes: mirror the vitest coverage excludes for
  core-trpc/src/providers/** and core-shared/src/trpc/context.ts so
  changes to coverage-excluded framework glue don't fail the diff gate.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK

scripts/coverage/diff.mjs

@@ -65,6 +65,12 @@ const ALLOWED_GLOBS = [
   /\/application\/services\//,
   /\/integrations\/cms\//,
   /\/ui\//,
+  // core-trpc React context providers — excluded from vitest coverage in
+  // core-trpc/vitest.config.ts ("integration-tested in the apps").
+  /\/src\/providers\//,
+  // core-shared tRPC context factory — excluded from vitest coverage in
+  // core-shared/vitest.config.ts ("wired at app bootstrap, not unit-testable").
+  /\/src\/trpc\/context\.ts$/,
   // Tooling packages that don't generate a vitest lcov (no @vitest/coverage-v8)
   /^packages\/core-testing\//,
   /^packages\/core-eslint\//,