```

refactor: Improve type safety and resolve static analysis warnings

Addresses PHPStan errors and warnings across entities and the security controller by enforcing strict type hints and best practices.

- **User.php**: Applied `readonly` and initialization (`= null`) to `$id` to satisfy PHP 8.1 rules for auto-generated Doctrine IDs. Added explicit array type hints (`array<string>`) and `type: json` for `$roles`.
- **ApiToken.php**: Added explicit array type hints for `$scopes` property and methods. Implemented the `\Stringable` interface.
- **SecurityController.php**: Added explicit type hints (`?User`, `JsonResponse`, `void`) to parameters and return types. Removed all remaining code comments.
```

Author: serega

.github/workflows/lint.yml

@@ -15,6 +15,10 @@ jobs:
       matrix:
         php-version: [ '8.1', '8.2' ]
 
+    defaults:
+      run:
+        working-directory: app   # 👈 all commands will run from /app
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
@@ -35,7 +39,7 @@ jobs:
         uses: actions/cache@v4
         with:
           path: ~/.composer/cache/files
-          key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
+          key: ${{ runner.os }}-composer-${{ hashFiles('app/composer.lock') }}
           restore-keys: |
             ${{ runner.os }}-composer-
 

app/.env.test

@@ -0,0 +1,4 @@
+# define your env variables for the test env here
+KERNEL_CLASS='App\Kernel'
+APP_SECRET='$ecretf0rt3st'
+SYMFONY_DEPRECATIONS_HELPER=999999

app/.gitignore

@@ -17,3 +17,8 @@ phpstan.neon
 /.phpcs-cache
 /phpcs.xml
 ###< squizlabs/php_codesniffer ###
+
+###> phpunit/phpunit ###
+/phpunit.xml
+/.phpunit.cache/
+###< phpunit/phpunit ###

app/composer.json

@@ -35,9 +35,12 @@
     },
     "require-dev": {
         "phpstan/phpstan": "^2.1",
+        "phpstan/phpstan-doctrine": "^2.0",
+        "phpunit/phpunit": "^10.5",
         "squizlabs/php_codesniffer": "*",
         "symfony/debug-bundle": "6.3.*",
         "symfony/maker-bundle": "^1.50",
+        "symfony/phpunit-bridge": "^7.3",
         "symfony/stopwatch": "6.3.*",
         "symfony/web-profiler-bundle": "6.3.*",
         "zenstruck/foundry": "^1.34"