[Feature] Gate coverage and close the weakest unit-test gaps

Coverage is measured on every CI run and then discarded. ci.yml's selftest job runs pytest selftests/ --cov=src/vip --cov-report=term-missing, but there is no --cov-fail-under, no Codecov integration and no threshold anywhere, so the number can drift downward indefinitely without anyone noticing.

Measured on main at 66a0c54c with uv run --extra dev pytest selftests/ --cov=src/vip: 1923 passed, 3 skipped, TOTAL 5263 statements, 1300 missed, 75%.

Weakest modules, worst first:

Three of these are worth prioritising for reasons beyond the raw number. clients/kubernetes.py at 18% is the weakest and backs a real product path, session capacity on Kubernetes; the only selftest that mentions Kubernetes exercises a configuration dataclass rather than the client itself. idp.py at 36% is the headless-auth IdP login strategy, which is security-sensitive. config.py at 43% is the single source of truth for parsing vip.toml, is pure logic with no I/O, and so is the cheapest of the three to cover meaningfully; configuration mistakes are also among the most common things a field user actually hits.

load_users.py at literal 0% is a separate decision rather than a gap to fill blindly: it is locust-backed load-generation code reached through load_engine.py, and is opt-in. Either give it minimal coverage or exclude it explicitly, so that 0% becomes a recorded decision instead of an accident.

Suggested first step: add --cov-fail-under set to the current value, so the number can only move up, then take config.py as the first target.

Start in ci.yml and inspect the selftest coverage command and existing tests under selftests/. Use the reported config.py, clients/kubernetes.py, and idp.py gaps to choose an initial coverage target, then verify the threshold prevents regressions. Resolve whether load_users.py receives minimal coverage or is explicitly excluded, and confirm the full pytest coverage run passes.