test(phase-1): feature coverage for security + data-integrity fixes

Seven feature tests, run against an in-memory SQLite forced via putenv
in setUp (keeps the shared dev DB safe). Covers:

- Reserved-identifier rule rejects admin / super_admin / takeone /
  support / etc, matches both name and email local-part only, and
  lets normal names through.
- SafeNotifier swallows a notification throw without re-raising.
- Identical comments within 60s collapse to the first row.
- X-Idempotency-Key returns the first comment on retry.
- Owner viewing their own video does not insert a video_views row.

AppServiceProvider stops force-upgrading the scheme in the testing env
so the HTTP test client isn't 302'd before reaching the controller.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

app/Providers/AppServiceProvider.php

@@ -26,8 +26,12 @@ class AppServiceProvider extends ServiceProvider
             \Illuminate\Http\Request::HEADER_X_FORWARDED_AWS_ELB
         );
         
-        // Force HTTPS
-        URL::forceScheme('https');
+        // Force HTTPS unless we're running under phpunit — the test client
+        // speaks plain http://localhost; forcing https would make every POST
+        // in a feature test resolve to a 302 instead of hitting the controller.
+        if (! $this->app->environment('testing')) {
+            URL::forceScheme('https');
+        }
 
         // Universal pagination view — used everywhere by default
         Paginator::defaultView('partials.pagination');