test: cover rental-service and fm-gateway low-coverage classes

[devin-ai-integration]

Summary

Test-only change. I measured JaCoCo line coverage per module (ignoring generated protobuf/gRPC/JAXB classes) and the two weak spots were rental-service (51.4%) and fm-gateway (71.9%); stations-service (87.1%) and the battery/tracking handwritten code (~89%) were already covered. This adds unit tests for the untested classes in those two modules:

module	handwritten line coverage	tests
rental-service	51.4% → 92.4%	63 → 166
fm-gateway	71.9% → 94.0%	34 → 53

rental-service, new tests for previously untested classes: AuthService, AuthSessionService, AuthController, ProcessExceptionHandler, ProcessSessionService, CamundaProcessInspector, CamundaMessageCorrelator, CamundaProcessVariablesWriter, BankClient, BankWorker, RentalWorker, VehicleWorker, NotificationWorker, ProcessSessionWorker, ProcessSession, plus the branch-heavy RentalService operations (scanQr/bookByType/undoBooking/getBooking/getMapStations) and the remaining RentalController endpoints (RentalService 20% → 97.8%, RentalController 16.7% → 100%).

fm-gateway: GraphHopperClient (10.5% → 86.8%), the FleetSimulator scheduled tick (initial 15s park, step advance, arrival, per-vehicle error isolation, gRPC failures), SimulationState and VehicleRoute.

Two things worth knowing about how the tests reach the collaborators:

• Camunda REST collaborators (CamundaProcessInspector, CamundaMessageCorrelator) and GraphHopperClient build their own RestClient from a base URL, so instead of mocking the client the tests point them at a JDK HttpServer bound to an ephemeral port and assert on the real request/response handling — including retry, 404/500 and connection-refused paths.
• Time- and randomness-dependent state is pinned via ReflectionTestUtils rather than sleeping, e.g. the simulator tick tests move a state's private start instant into the past:

SimulationState state = new SimulationState("V001", route, "1", route.getDestinationStationName());
ReflectionTestUtils.setField(state, "startTime", Instant.now().minusSeconds(1)); // skip the 15s park
activeSimulations().put("V001", state);
simulator.executeSimulationTick();

No production code was touched. Frontend (Angular) tests were left as-is: ng test on main already fails 2 of 47 specs (rideCompletionGuard direct-URL redirect, and ActiveRideComponent transient summary) — pre-existing failures unrelated to this change.

Link to Devin session: https://app.devin.ai/sessions/ff9b031943194070bd76b738071dd2fe
Requested by: @NicolasCola7

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring