chore: remove dead _checkPermission param + CI coverage gate (#107)

[cheerc]

Summary

Final cleanup PR for #107 coverage sprint — dead code removal + CI hardening.

Changes

1. _checkPermission(createdBy) → _checkPermission()

The createdBy parameter became dead code after #152 (all logged-in users can edit). This PR:

• Removes the parameter from the function signature
• Removes the argument from all 4 callers (saveData, updateScheduleMetadata, deleteSchedule, copySchedule)
• Removes the now-unused const createdBy = rowValues[3] declarations
• Removes unused rowValues destructuring in 2 functions
• Updates backendSignatureContracts.test.js expected param count: 1 → 0

2. EXTRACTED_TO_LIB cleanup

No action needed — grep found zero EXTRACTED_TO_LIB or NOT_EXTRACTABLE comments in JavaScript.html.

3. CI coverage gate

Changed CI t8 Vitest step from npm test to npx vitest run --coverage so coverage thresholds (defined in vitest.config.js) are enforced on every PR.

4. PHP P2 verification

Existing 60 PHP tests already cover both targets:

• index.php routing → IndexRoutesTest.php (10 tests, subprocess-isolated route error paths)
• generate_iframe.php access → AccessControlTest.php (5 tests, token-based access control)

Files Changed (3)

File	Change
程式碼.js	Remove dead createdBy param + unused variables (-8 lines)
tests/unit/backendSignatureContracts.test.js	Param count 1 → 0
.github/workflows/ci.yml	npm test → npx vitest run --coverage

Verification

• npx eslint 程式碼.js — 0 errors ✅
• npm test — 1164/1164 pass ✅
• npx vitest run --coverage — all thresholds pass ✅

refs #107
follows spec

[cheerc]

✅ VERIFIED

Reviewed HEAD: 86b5008
Reviewer: cb-team-reviewer
Audit mode: standard (D2, lenses: correctness + security)

Files Reviewed (3)

• 程式碼.js — _checkPermission dead param removal + unused variable cleanup
• tests/unit/backendSignatureContracts.test.js — param count 1→0
• .github/workflows/ci.yml — npm test → npx vitest run --coverage

Stage 1 — Correctness

• _checkPermission(createdBy) → _checkPermission() at all 4 callers (L209/368/417/458) ✓
• const createdBy = rowValues[3] removed at saveData/updateScheduleMetadata/deleteSchedule/copySchedule ✓
• values: rowValues destructuring simplified where only used for createdBy ✓
• copySchedule still uses sourceRowValues[4] (isDraft) — correct, only createdBy removed ✓
• Remaining createdBy references are response payload (getData L137/153, addSchedule L337, copySchedule L479) — NOT permission checks ✓
• Signature contract: ['_checkPermission', 1] → ['_checkPermission', 0] ✓
• CI: npx vitest run --coverage enforces vitest.config.js thresholds in CI ✓

Stage 2 — Security

• Login guard if (!currentUser) throw still preserved in _checkPermission() ✓
• All 4 mutation paths still call _checkPermission() ✓
• No permission bypass introduced — param removal only (logic unchanged from 預設所有登入使用者皆可編輯資料表（權限模型簡化） #152) ✓

Evidence

• ran: grep _checkPermission|createdBy 程式碼.js → 4 callers (no args), 4 response-only createdBy refs
• cited: 程式碼.js:43 — function _checkPermission() (param removed)
• cited: 程式碼.js:45-46 — login guard preserved
• cited: ci.yml:27-28 — npx vitest run --coverage
• cited: backendSignatureContracts.test.js:61 — ['_checkPermission', 0]