test: add 29 new tests for cleanup, orchestrator, findings, tool registry, models

- cleanup.rs: 8 tests — routing logic, skip conditions, missing config errors
- orchestrator.rs: 7 tests — summarize_tool_output (screenshot strip, truncation, recursion)
- findings.rs: 6 tests — empty state, severity grouping, SAST correlation, evidence table
- tools/mod.rs: 4 tests — registry completeness, schema validation, browser action enum
- models.rs: 4 tests — TestUserRecord serde, IdentityProvider variants, BSON roundtrip

Total: 326 tests (was 297)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

compliance-core/tests/models.rs

@@ -517,6 +517,69 @@ fn pentest_auth_config_default() {
     assert!(!auth.cleanup_test_user);
 }
 
+// ─── TestUserRecord ───
+
+#[test]
+fn test_user_record_default() {
+    let r = pentest::TestUserRecord::default();
+    assert!(r.username.is_none());
+    assert!(r.email.is_none());
+    assert!(r.provider_user_id.is_none());
+    assert!(r.provider.is_none());
+    assert!(!r.cleaned_up);
+}
+
+#[test]
+fn test_user_record_serde_roundtrip() {
+    let r = pentest::TestUserRecord {
+        username: Some("pentestuser".into()),
+        email: Some("pentest+abc@scanner.example.com".into()),
+        provider_user_id: Some("kc-uuid-123".into()),
+        provider: Some(pentest::IdentityProvider::Keycloak),
+        cleaned_up: false,
+    };
+    let json = serde_json::to_string(&r).unwrap();
+    let back: pentest::TestUserRecord = serde_json::from_str(&json).unwrap();
+    assert_eq!(back.username, Some("pentestuser".into()));
+    assert_eq!(back.provider, Some(pentest::IdentityProvider::Keycloak));
+    assert!(!back.cleaned_up);
+}
+
+#[test]
+fn identity_provider_serde_all_variants() {
+    for (variant, expected) in [
+        (pentest::IdentityProvider::Keycloak, "\"keycloak\""),
+        (pentest::IdentityProvider::Auth0, "\"auth0\""),
+        (pentest::IdentityProvider::Okta, "\"okta\""),
+        (pentest::IdentityProvider::Firebase, "\"firebase\""),
+        (pentest::IdentityProvider::Custom, "\"custom\""),
+    ] {
+        let json = serde_json::to_string(&variant).unwrap();
+        assert_eq!(json, expected);
+        let back: pentest::IdentityProvider = serde_json::from_str(&json).unwrap();
+        assert_eq!(back, variant);
+    }
+}
+
+#[test]
+fn pentest_session_with_test_user() {
+    let mut s = pentest::PentestSession::new("t".into(), pentest::PentestStrategy::Quick);
+    assert!(s.test_user.is_none());
+    s.test_user = Some(pentest::TestUserRecord {
+        username: Some("pentester".into()),
+        email: Some("pentest+123@example.com".into()),
+        provider_user_id: None,
+        provider: Some(pentest::IdentityProvider::Auth0),
+        cleaned_up: false,
+    });
+    let bson_doc = bson::to_document(&s).unwrap();
+    let back: pentest::PentestSession = bson::from_document(bson_doc).unwrap();
+    assert!(back.test_user.is_some());
+    let tu = back.test_user.as_ref().unwrap();
+    assert_eq!(tu.username, Some("pentester".into()));
+    assert_eq!(tu.provider, Some(pentest::IdentityProvider::Auth0));
+}
+
 // ─── Serde helpers (BSON datetime) ───
 
 #[test]