Add controller tests for GameController's single-game endpoints

[dmccoystephenson]

Summary

• Adds GameControllerTest, a @WebMvcTest covering the six single-game (unauthenticated, shared-GameService-state) endpoints on GameController: GET /state, POST /tick, POST /command, POST /api/reset, GET /api/ruler-stats, and POST /api/decision.
• GameControllerAuthTest (existing) only exercises the authenticated /api/session/* routes; the endpoints above had zero controller-level coverage, most notably the /api/decision exception-to-HTTP-status mapping (IllegalStateException → 409 cooldown, IllegalArgumentException → 400 invalid choice, missing category/choice → 400) which previously had no test at any layer.
• Characterization only — no production code changed, no behavior changed.

Scope note

This is a Stage B (unit-test expansion) cycle. The single open issue in the backlog (#55, "Make the dashboard layout configurable and persist it per account") requires reorder/show-hide UI plus new server-side per-user persistence — too large to fully close in one scoped PR without leaving the issue partially resolved, so it was left open and deferred rather than picked for this cycle.

Module(s) touched

• backend only (test sources)

Test plan

• mvn clean test in backend/ — 267 tests, 0 failures (up from 256; +11 new)
• mvn clean test in web-client/ — 14 tests, 0 failures (unaffected, included to confirm no cross-module drift)
• New tests confirmed passing individually first (-Dtest=GameControllerTest)

Closes: none (test-only addition, no tracked issue for this gap)

---

This PR description was drafted during a Gardener session (Stephenson-Software/gardener).

[dmccoystephenson]

Self-review rubric:

• Scope: PASS — the only change is one new test file (GameControllerTest.java), and every test in it exercises one of the six previously-uncovered single-game endpoints on GameController. No production code, formatting, or unrelated files touched.
• Tests-new: PASS — all six endpoints (GET /state, POST /tick, POST /command, POST /api/reset, GET /api/ruler-stats, POST /api/decision) now have at least one MockMvc test; /api/decision additionally has 5 tests covering its full validation/exception-mapping branches.
• Tests-fix (empirical): PASS — temporarily changed the /api/decision CONFLICT/BAD_REQUEST responses to 418 I'm a teapot in GameController.java and reran GameControllerTest: decisionOnCooldownReturns409 and decisionWithInvalidChoiceReturns400 both failed (expected:<409> but was:<418>, expected:<400> but was:<418>), confirming the tests are not vacuous. Reverted immediately after (git checkout --), diff confirmed clean.
• Sibling structure: PASS — mirrors GameControllerAuthTest/AuthControllerTest conventions in the same package: @WebMvcTest(GameController.class) + @import(AuthCookies.class), @MockBean collaborators, static MockMvc matcher imports.
• Sibling renames: N/A — no renames in this PR.
• Docs: PASS — no player-visible behavior changed (test-only addition), so no README/PLAYER_GUIDE/CHANGELOG/MVP/DOCS.md updates apply. Verified README's Backend API section already matches the actual controller mappings in both controllers (checked during triage, unrelated to this diff).
• Issue resolution: N/A — no Closes #N in this PR; it isn't tied to a tracked issue (the one open issue, Make the dashboard layout configurable and persist it per account #55, was evaluated and found too large to close in a single scoped PR — see PR description).
• CI: PASS — both "Backend Build and Test" and "Web Client Build and Test" green on the PR head (https://github.com/Preponderous-Software/barony/actions/runs/30771033564).

Repo-specific:

• Both-modules: PASS — mvn clean test green in both backend (267 tests) and web-client (14 tests, unaffected by this change).
• API-contract: N/A — no REST endpoint path/request/response shape changed.
• Changelog: N/A — no player-visible change.
• Constructor-injection: N/A — no new Spring components added.
• Override-correct: N/A — no @OverRide methods added.

Summary: test-only PR adding controller-layer coverage for GameController's six previously-untested single-game endpoints, empirically verified to catch real regressions. No follow-up needed on this PR.

---

This comment was drafted during a Gardener session (Stephenson-Software/gardener).