test: cover EmailToken and TokenService signature method behaviors

[maia-andre]

Ref: #8053

📝 Summary

Two closely related source/test pairs from #8053 (as claimed on the issue):

• lib/Service/IdentifyMethod/SignatureMethod/TokenService.php
• lib/Service/IdentifyMethod/SignatureMethod/EmailToken.php

Infection baseline for the two files: 23 mutants generated, 1 escaped, Covered Code MSI 95%. The escaped mutant is the MethodCallRemoval of $this->twofactorGatewayService->ensureAvailable($gatewayName) in sendCodeByGateway() — no scenario exercised an unavailable gateway. One correction to my claim comment: sendCodeByEmail(), requestCode() and validateToSign() did have indirect coverage from elsewhere in the unit suite; what was missing were direct tests pinning their observable behavior, plus the escaped kill.

This PR only adds tests — no production code changes:

• testSendCodeByGatewayThrowsWhenGatewayAppIsNotEnabled: kills the escaped mutant. With the call in place, ensureAvailable() throws LibresignException("App Two-Factor Gateway is not enabled."); with the call removed, execution reaches isGatewayComplete() and throws OCSForbiddenException instead, so the expected exception class/message pins the guard.
• testSendCodeByEmailSendsCodeAndReturnsHashedCode: direct test asserting code generation (TOKEN_LENGTH, digits), delivery via MailService::sendCodeToSign() and the hashed return value.
• EmailToken::requestCode(): both display-name branches (distinct name is forwarded; name equal to the identifier is sent as an empty string), asserting the hashed code is persisted via IdentifyService::save().
• EmailToken::validateToSign(): valid code passes; wrong code throws Invalid code.; a code sent without ever being requested also throws.
• Typo fix: testVaidateEmail → testValidateEmail (and its data provider); removed a dead mock assignment in setUp().

After the change, Infection reports 29 mutants generated, 0 escaped, 0 uncovered — Covered Code MSI 100% for this scope (17 killed by tests, 12 detected via fatal errors).

🧪 How to test

composer test:unit -- --filter "TokenServiceTest|EmailTokenTest"

XDEBUG_MODE=coverage vendor/bin/infection --configuration=infection.json5 \
  --test-framework-options="--testsuite=unit" --show-mutations \
  lib/Service/IdentifyMethod/SignatureMethod/TokenService.php \
  lib/Service/IdentifyMethod/SignatureMethod/EmailToken.php

Expected: tests green; 29 mutants generated, 0 escaped, Covered Code MSI 100%.

⚙️ API / Back‑end changes

• Unit and/or integration tests added – required for backend changes

Test-only change; no production code, capabilities, or API documentation affected.

✅ Checklist

• I have read and followed the contribution guide.
• Full unit suite, focused Infection and php-cs-fixer pass for the changed files.

🤖 AI (if applicable)

• The content of this PR was partially or fully generated using AI