refactor: triage the last three SonarQube findings - #102

Closes #79, closes #82, and answers #81. These were the needs-triage Sonar issues — each needed a decision rather than a mechanical fix, so this PR is mostly the reasoning.

#79 — four empty controller actions: deleted

def edit; end, def new; end × 3. Rails renders the matching template whether or not the action is defined, so all four were genuinely inert.

The issue asked for two things to be checked before removing any of them, so:

1. Do the filters introspect the action list? No. allow_unauthenticated_access only: %i[new create] and rate_limit … only: :create match on action_name, which comes from the route.
2. Does posts#edit's before_action still run? Yes — only: %i[edit update destroy] matches the action name, not a method.

Evidence rather than reasoning alone: all four routes are covered by request specs (post_ownership_spec, not_found_spec, passwords_spec ×2, sessions_spec), 223 request examples pass, and /session/new and /passwords/new both return 200 against a running server.

Deleting rather than adding four "this is empty on purpose" comments: documenting an absence four times is worse than not having the absence. The convention is recorded once in CLAUDE.md so the next reader — human or agent — doesn't reintroduce them or read the gap as an oversight.

#81 — requires below the top of the file: refused, with the reason in the code

Both are deliberate, and for different reasons, which is why this needed looking at rather than applying:

• opentelemetry.rb — loading the SDK is what starts it. Hoisting the requires would mean every rails command pays for instrumentation nobody asked for. That's a behaviour change and it would undo ADR 0009.
• rails_helper.rb — it's a glob. There is no static require to hoist.

Both now carry that reasoning as a comment at the site. A won't-fix whose reason lives only on a dashboard is how a scanner stops being believed — and I can't mark them resolved in SonarCloud from here anyway (that needs the token), so that step is yours: the two findings will keep appearing until they're dismissed there, and the code now tells whoever does it why.

#82 — coverage reading 76.8%: option 1

sonar.coverage.exclusions for web/app/javascript/** and web/app/views/**, with the reasoning in sonar-project.properties.

Both numbers were honest — they measured different things — but the headline understated the suite, and a metric that has to be explained every time gets dismissed. Coverage now describes the Ruby, because the Ruby is what SimpleCov can instrument.

This narrows one metric, not the scan: every excluded file is still analysed for bugs, smells and vulnerabilities. It's also the prerequisite for making the quality gate blocking, since a gate on a number nobody believes is theatre.

Verified: 380 examples green, RuboCop clean, script/smoke-test passed.

Generated by Claude Code