Expand SonarQube coverage exclusions for untestable code

[BrewingCoder]

Problem

SonarQube quality gate fails on PRs because new_coverage = 0% on files that cannot be unit tested without a database. The current coverage exclusions only cover **/generated/** and **/*_test.go.

Files that need coverage exclusions

These files contain resolver/handler code that requires PostgreSQL + ClickHouse to test:

• **/schema.resolvers.go — GraphQL resolvers (require DB for integration testing)
• **/resolver.go — Resolver helper methods (DB-dependent)
• **/worker/*.go — Kafka workers (require message queue + DB)
• **/main.go — Application entrypoint
• **/migrations/** — Already excluded
• **/generated/** — Already excluded

Action Items

• Add coverage exclusions to SonarQube API (sonar.coverage.exclusions)
• Add matching exclusions to sonarqube.yml workflow args
• Re-enable coverage threshold in HoldFast quality gate (currently set to 0% as workaround)
• Set a realistic new_coverage threshold (e.g., 50%) once exclusions are correct
• Verify gate passes on a backend-only PR

Context

The HoldFast custom quality gate was created to replace the default "Sonar way" gate:

• new_coverage: currently 0% (needs proper exclusions before re-enabling)
• new_duplicated_lines: <= 3%
• new_violations: <= 10
• security_hotspots_reviewed: 100%

🤖 Generated with Claude Code

[github-actions]

AI Triage: SonarQube quality gate needs expanded coverage exclusions for untestable code (resolvers, workers, migrations) that require database/message queue integration.

Labels applied: area:backend, tech-debt, area:ci, priority:medium, component:database