Integration tests are currently broken so the cmd/ entry points
(pktvisord, pktvisor-reader) aren't being exercised by ctest. Showing
them at 0% drags the project number down without informing decisions.
Restore the cmd/* exclusion to the lcov EXCLUDE list (it was dropped
in chore/coverage-on-prs); revisit once integration tests are fixed.

Phase 2.1 of the coverage initiative. NetProbeStreamHandler.cpp was the
worst-covered handler (41.5% line coverage). The pre-existing tests in
this file relied on real network and raw-socket privileges (`localhost`
ICMP ping, `www.google.com:80` TCP) and only asserted `attempts >= 0`,
which always passes — they Bus-errored in CI without verifying anything
meaningful.

Add six new TEST_CASEs tagged [netprobe][unit] that exercise the
manager and bucket APIs directly through a small `UnitFixture` (which
constructs the handler and calls start() so the metrics manager's
_groups bitset is configured — directly constructing a bare manager
segfaults in group_enabled()):

- process_failure walks every ErrorType enum value and verifies the
  correct counter (dns_lookup_failures / packets_timeout /
  connect_failures) increments per target via to_json()
- process_netprobe_tcp send/recv exercises the success path of the
  transaction manager (start → end within TTL → new_transaction)
- process_netprobe_tcp timeout exercises the timed-out path with a
  6s gap exceeding the default 5s TTL
- process_filtered exercises the filtered-event path
- to_prometheus is exercised by emitting a failure and grepping the
  output for the metric name + target label
- specialized_merge across two managers verifies bucket aggregation

Skip the two pre-existing network-dependent tests with SKIP() so they
no longer abort the test process before the new ones run (Catch2
randomizes order). They're left in place for someone with priviledges
to revisit, but the unit tests above cover the same code paths
deterministically.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Phase 2.1 easy-win: every *HandlerModulePlugin.cpp and
*InputModulePlugin.cpp was sitting at 0% coverage because:

- setup_routes() is called only from init_plugin() when start() is
  invoked with a non-null HttpServer; existing tests pass nullptr,
  short-circuiting the call.
- instantiate() is only reached through full Tap/Policy creation,
  which doesn't enumerate every plugin.

Add src/tests/test_module_plugins.cpp with three TEST_CASEs:

1. CoreRegistry::start with a real HttpServer — exercises every
   plugin's setup_routes() body in one shot. Most are empty stubs but
   they all need to compile and not crash; previously all 16 were 0%.

2. Iterate registry.input_plugins(), invoke instantiate() and
   generate_input_name() on each. Verifies basic plugin contract.

3. Iterate registry.handler_plugins(); for each, look up a compatible
   input proxy from the kHandlerProxy table (derived from each
   handler's dynamic_cast<*InputEventProxy*>(proxy) call sites) and
   call instantiate() with that proxy.

Net effect: ~150 previously-uncovered lines across 16 tiny .cpp files
are now exercised in a single fast unit test (~30ms locally).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Per review feedback the backend tests just verified prom output started
with the right schema prefix and that the otel scope had >0 metrics —
neither caught regressions in actual metric content. Tighten every check
to round-trip a known counter value through both backends.

New shared helper libs/visor_test/catch2/otel_helpers.hpp:

  otel_gauge_value(scope, name)  -> first int gauge data point
  otel_gauge_sum(scope, name)    -> sum across data points (for v2
                                    handlers that slice by `direction`)

Per-handler tightening:

- BGP backends: prom must contain `bgp_wire_packets_{total,open,update,
  keepalive}` lines with values 9/2/4/3 (matches the parse test
  fixture); otel mirrors them.
- DHCP backends: same idea — DISCOVER=1, OFFER=1, REQUEST=3, ACK=3.
- DNS v1 backends: switched fixture to dns_ipv4_udp.pcap so we can
  assert UDP=140, IPv4=140, queries=70, replies=70 against both
  backends.
- DNS v2 backends: same fixture; v2 collapses query+reply into xacts,
  metrics use the suffix-form `dns_xacts`/`dns_udp_xacts`/`dns_ipv4_xacts`.
  v2 also emits per-direction series so we use otel_gauge_sum.
- Net v1 backends: assert `packets_udp/ipv4/ipv6` == 140/140/0 — v1
  has flat (un-labelled) counters.
- Net v2 backends: same fixture, but v2 metric names use the
  `_packets` suffix and slice by direction → use otel_gauge_sum.

Merge tests:

- Flow specialized_merge: snapshot `flow_records_flows` per bucket
  before merge, assert post-merge value equals their sum.
- DNS v2 specialized_merge: same pattern with `dns_xacts`.
- Net v2 process_net_layer + merge: assert `net_total_packets` == 4
  after the four direct process_net_layer calls and the merge.

Overload tests:

- DNS v1 process_dns_layer(l3, l4, QR): snapshot pre-call counters,
  invoke 2 UDP queries / 1 UDP response / 1 TCP query, assert exact
  delta (+3 queries, +1 reply, +3 udp, +1 tcp) via otel.
- Net v1 process_net_layer(dir, l3, l4, size): snapshot counters,
  invoke 3 calls (toHost UDP IPv4 / fromHost TCP IPv4 / unknown UDP
  IPv6), assert exact deltas via otel.