test: cover three modules that had no unit spec at all

[hahwul]

Motivation

Mapping spec coverage across the tree turned up three files with no direct unit spec — not one reference anywhere under spec/, despite being pure, deterministic logic sitting under decisions that matter:

File	LOC	What it decides
src/tagger/framework_taggers/go/group_scope.cr	172	Which URL prefix a Go middleware registration guards
src/miniparsers/js_object_config_extractor.cr	217	Payload CMS / Strapi declarative config decoding
src/ai_context/source_reader.cr	240	The source snippets the AI context is built from

Each was reachable only through functional tests of its callers, so a regression in the shared logic would surface (if at all) as a puzzling endpoint diff several layers away.

What's covered

GoRouteGroupScope (39 examples) — go_auth and go_security both build their guarded-prefix list from this module, so a wrong answer here is a security-tag false positive. The specs pin the behaviours its header comment says it exists for:

• sibling assignment groups staying independent instead of accumulating (api then admin must not resolve to /api/admin)
• a non-literal group path (r.Group(cfg.APIBase)) resolving to Unknown rather than collapsing to Global — collapsing would tag every endpoint, including the explicitly public ones, as guarded
• a line that is both a closure and an assignment group not folding its own prefix in twice
• closure frames retiring on brace unwind, chained Group(...).Use(...), and Party/Pre router dialects

NoirAIContext::SourceReader (47 examples) — its character budget is load-bearing: a snippet truncated before the suppressing evidence becomes a false positive downstream. Covers the budget (default, caller-supplied, and the exact-fit boundary), the three caches, and the block-boundary walk across all four styles — brace / python / ruby / bare statement — including the decorator lead-in and the indent guard behind the django /public/ false positive.

Noir::JSObjectConfigExtractor (39 examples) — every declaration shape its header comment claims to handle (TS type annotation, satisfies, call argument, module.exports), the value decoder including the statically-unresolvable-but-key-still-recorded case, and both depth guards.

Drive-by fix

src/models/code_locator.cr referenced NoirLogger and any_to_bool without requiring either. It compiled only because every real entry point happens to require logger.cr first — require-ing source_reader.cr on its own failed to compile. Requiring a file's own dependencies is what makes anything downstream of it unit-testable in isolation.

Verification

• 125 new examples, all passing
• crystal spec spec/unit_test — 4619 examples, 0 failures
• crystal spec spec/functional_test — 22647 examples, 0 failures
• just check — 1842 files inspected, 0 failures

No production behaviour changes; the only src/ edit is two require lines.