P2.9: convert tests to exercise real Craft APIs instead of synthetic event objects

[sjelfull]

P2.9: convert 24 tests to real Craft API calls

Replaces synthetic event triggers with real Craft API calls across 5 test files. Previously, tests like SchemaEventsTest would fire Craft::$app->getDb()->trigger(DbEvent::EVENT_AFTER_OPEN) directly — which exercises the handler's listener but not the actual Craft code path that fires the event. This branch rewires those tests to call the real API (Craft::$app->getEntries()->saveSection(), Craft::$app->getRoutes()->saveRoute(), etc.) so the full production code path runs.

The conversion surfaced 3 real bugs that synthetic tests had been hiding: (1) user permissions are lowercased before persist, so assertions need to match lowercase; (2) section saves require pre-saved entry types attached to the section model; (3) Routes::saveRoute() returns a UID string, not a bool. All three are now correctly handled in the tests. Some tests are intentionally kept handler-direct with explanatory comments: PluginEventsTest (no fixture plugin to install), UserEventsTest (no real session in headless test environment), DatabaseEventsTest (real backups are slow and have filesystem side effects).

What changed

• tests/Pest.php (+40 LOC) — adds _audit_register_listeners_for_tests(), a reflection-based helper that registers handler listeners without going through the full plugin bootstrap. Used by tests that call real Craft APIs but need the audit listeners wired up.
• tests/Feature/SchemaEventsTest.php — largest change (+108/-98): all schema-change tests now call Craft::$app->getDb()->createTable() etc. instead of triggering events directly.
• tests/Feature/UserSecurityEventsTest.php (+71/-38) — login/logout/password tests use real Craft::$app->getUsers() calls.
• tests/Feature/PermissionEventsTest.php (+55/-63) — permission grant/revoke tests use real Craft::$app->getUserPermissions() calls; fixes the lowercase-permissions bug.
• tests/Feature/RouteEventsTest.php (+30/-24) — route tests use Craft::$app->getRoutes()->saveRoute(); fixes the UID-not-bool return.
• tests/Feature/PluginEventsTest.php (+18/-3) — adds why-comment explaining handler-direct approach.
• tests/Feature/UserEventsTest.php (+11/-1) — adds why-comment for headless session limitation.
• tests/Feature/DatabaseEventsTest.php (+14) — adds why-comment for backup side effects.
• tests/Unit/ProjectConfigTrackerTest.php (+26) — adds real project-config round-trip coverage.

Tests

• 24 tests converted to real API calls
• ECS clean
• PHPStan clean
• Fresh-DB green

Stacked on

p2.8-comment-cleanup (#114)

[sjelfull]

This change is part of the following stack:

• Phase 1.1 — Foundation: AuditEvent enum + JSON snapshot migration #90
  • Phase 1.2 — Core services: AuditRecorder + FieldDiffService + HandlerRegistry #91
    • Phase 1.3 — Field handlers: 15 handlers for native + third-party fields #92
      • Phase 1.4 — Project config tracking: 8 config areas #93
        • Phase 1.5 — UI: DiffRenderer + 20 Twig templates + asset bundle #94
          • Phase 1.6 — Tests: migration + integration + enum coverage (+19 tests) #95
            • Phase 2.1 — Decompose AuditService: ElementHandler, UserHandler, UserGroupHandler #96
              • Phase 2.2 — Decompose AuditService: Schema/Route/Backup/Plugin/Settings handlers #97
                • Phase 2.3 — Repoint event wiring from AuditService to handler services #98
                  • Phase 2.4 — Migrate Pest tests from AuditModel::EVENT_* to AuditEvent enum #99
                  • Phase 2.5 — CI: PHP 8.2/8.3/8.4 matrix + v3 branch trigger #111
                  • Phase 3.0 — Docs: ship escape hatch (filter-records + getting-started + events-and-recording) #110
                  • P2.6: drop @deprecated AuditService delegators, move @internal helpers to AuditRecorder #112
                  • P2.7: drop @deprecated EVENT_/USER_ string constants from AuditModel, migrate to AuditEvent::Xxx->value #113
                  • P2.8: strip section-divider banners and boilerplate file/class headers #114
                  • P2.9: convert tests to exercise real Craft APIs instead of synthetic event objects #115 ◀
                  • P3.1: batch processing foundation — BatchService + auto-attach + 3 enum cases + 13 tests #116
                  • P3.2: migrate ResaveElements to BatchService — kills cache-key concurrency bug #117
                  • P3.4: Feed Me bake-in — auto-batch each feed import via EVENT_BEFORE/AFTER_PROCESS_FEED #119
                  • P3.3: CP UI — expandable indented batch children in audit log index #120
                  • P3.5: Feed Me integration tests — real class-string event dispatch verified #121
                  • P3.6: Fix snapshot column double-JSON-encoding (FRE-239) #122
                  • P3.7: Stack-wide comment cleanup pass #123

_{Change managed by git-spice.}