test(wl_presence): cover KV-store helpers + KV branches + defensive checks — G3 batch 3

Item G3 of v1.1 test-coverage push, third batch. Closes the
wl_presence coverage gap from 40% to 100% (+60pp, +100 covered
lines) with 31 new unit tests across 6 new classes.

Existing tests only exercised the in-memory path (session_key=None
fallback). These new tests cover the production KV path, which is
what the REST handler uses for cross-worker safety.

TestPresenceKvHelpers (2 tests, lines 45-50):
  - _kv_url with/without key

TestKvReadCsv (7 tests, lines 53-80):
  - 200 + payload → users dict parsed correctly
  - ResourceNotFound → None
  - generic exception → None (fail-open)
  - non-200 → None
  - malformed outer JSON → None
  - non-dict payload → {} (defensive normalization)
  - malformed inner payload → {}

TestKvWriteCsv (7 tests, lines 83-135):
  - update 200 → True
  - 404 update → falls to insert; 201 insert → True
  - 500 update → False
  - ResourceNotFound update → falls to insert
  - generic exception → False
  - update 404 + insert 500 → False
  - update 404 + insert exception → False (covers line 113)

TestKvDeleteCsv (3 tests, lines 138-151):
  - delete 200 → True
  - exception swallowed → False
  - HTTP DELETE method used

TestKvListAll (8 tests, lines 154-193):
  - 200 + JSON list → dict keyed by _key
  - exception → {}
  - non-200 → {}
  - non-list response → {}
  - malformed JSON → {}
  - records missing _key skipped
  - non-dict records skipped
  - records with malformed payload skipped

TestPresenceKvBranches (8 tests, KV branches of public API):
  - report_presence: full flow (read + list + write) via KV
  - get_presence: KV path returns presence
  - get_presence: empty KV record → empty presence list
  - get_presence: skips users with non-dict data (line 304 defensive)
  - cleanup_presence: stale-only record → DELETEd via KV
  - cleanup_presence: active record → no write, no delete
  - cleanup_presence: mixed active+stale → write_csv update only
  - reset_presence: enumerates + deletes each record

Mock infrastructure: same _make_splunk_mock + _patch_splunk pattern
used by test_ratelimit.py (G3 batch 2). _FakeResourceNotFound is
a real exception class so `except splunk.ResourceNotFound:` clauses
in production code catch correctly.

Coverage delta: bin/wl_presence.py 40% → 100% (0 lines uncovered).
Total bin/ coverage: 2088 → 2188 covered lines (28% → 30%).
Tests pass: 729/729 unit (was 671 — added 58: 31 KV-helper + KV-
branch tests plus the 27 from G3 batch 2 already pushed).

Author: RelativisticJet