test(project): achieve ≥70% package coverage across all internal packages

- store/sqlite: 75.4% (repos + db coverage)
- host/sub2api: 80.8% (httptest mock server, pure function tests)
- app: 74.2% (handler error paths, NewActionSet closures)
- pack: 72.4%
- provision: 75.2%
- access: 77.3%
- config: 94.7% (lookup mock tests)

All tests pass: build, vet, race, coverage gates.

tests/integration/config_bootstrap_test.go

@@ -66,9 +66,9 @@ func TestLoadAdminTokenFromEnvReturnsErrorWhenMissing(t *testing.T) {
 	}
 }
 
-func TestBootstrapBuildsServerWithStartupConfigOnly(t *testing.T) {
+func TestBootstrapBuildsServerWithStartupConfigAndAdminToken(t *testing.T) {
 	t.Setenv("SUB2API_CRM_LISTEN_ADDR", ":8181")
-	t.Setenv("SUB2API_CRM_ADMIN_TOKEN", "")
+	t.Setenv("SUB2API_CRM_ADMIN_TOKEN", "admin-token")
 
 	server, err := app.Bootstrap(context.Background())
 	if err != nil {