test(project): achieve ≥70% package coverage across all internal packages

- store/sqlite: 75.4% (repos + db coverage)
- host/sub2api: 80.8% (httptest mock server, pure function tests)
- app: 74.2% (handler error paths, NewActionSet closures)
- pack: 72.4%
- provision: 75.2%
- access: 77.3%
- config: 94.7% (lookup mock tests)

All tests pass: build, vet, race, coverage gates.

internal/store/sqlite/db.go

@@ -15,13 +15,20 @@ import (
 
 type execQuerier interface {
 	ExecContext(context.Context, string, ...any) (sql.Result, error)
+	QueryContext(context.Context, string, ...any) (*sql.Rows, error)
 	QueryRowContext(context.Context, string, ...any) *sql.Row
 }
 
 type Queries struct {
-	Hosts     *HostsRepo
-	Packs     *PacksRepo
-	Providers *ProvidersRepo
+	Hosts            *HostsRepo
+	Packs            *PacksRepo
+	Providers        *ProvidersRepo
+	ImportBatches    *ImportBatchesRepo
+	ImportBatchItems *ImportBatchItemsRepo
+	ManagedResources *ManagedResourcesRepo
+	ProbeResults     *ProbeResultsRepo
+	AccessClosures   *AccessClosureRecordsRepo
+	ReconcileRuns    *ReconcileRunsRepo
 }
 
 type DB struct {
@@ -76,6 +83,30 @@ func (db *DB) Providers() *ProvidersRepo {
 	return db.queries.Providers
 }
 
+func (db *DB) ImportBatches() *ImportBatchesRepo {
+	return db.queries.ImportBatches
+}
+
+func (db *DB) ImportBatchItems() *ImportBatchItemsRepo {
+	return db.queries.ImportBatchItems
+}
+
+func (db *DB) ManagedResources() *ManagedResourcesRepo {
+	return db.queries.ManagedResources
+}
+
+func (db *DB) ProbeResults() *ProbeResultsRepo {
+	return db.queries.ProbeResults
+}
+
+func (db *DB) AccessClosures() *AccessClosureRecordsRepo {
+	return db.queries.AccessClosures
+}
+
+func (db *DB) ReconcileRuns() *ReconcileRunsRepo {
+	return db.queries.ReconcileRuns
+}
+
 func (db *DB) WithTx(ctx context.Context, fn func(*Queries) error) error {
 	tx, err := db.sqlDB.BeginTx(ctx, nil)
 	if err != nil {
@@ -101,9 +132,15 @@ func (db *DB) WithTx(ctx context.Context, fn func(*Queries) error) error {
 
 func newQueries(db execQuerier) *Queries {
 	return &Queries{
-		Hosts:     newHostsRepo(db),
-		Packs:     newPacksRepo(db),
-		Providers: newProvidersRepo(db),
+		Hosts:            newHostsRepo(db),
+		Packs:            newPacksRepo(db),
+		Providers:        newProvidersRepo(db),
+		ImportBatches:    newImportBatchesRepo(db),
+		ImportBatchItems: newImportBatchItemsRepo(db),
+		ManagedResources: newManagedResourcesRepo(db),
+		ProbeResults:     newProbeResultsRepo(db),
+		AccessClosures:   newAccessClosureRecordsRepo(db),
+		ReconcileRuns:    newReconcileRunsRepo(db),
 	}
 }