Settings form: round-trip coverage, stop calling GitHub on every save, drop dead settings

[nuest]

Three changes to the plugin settings form, each found by the one before it.

Round-trip coverage (e2e)

A setting is wired up in three separate places — initData(), readInputData() and execute() — and omitting it from any one loses the value in silence: getData() returns null, updateSetting() writes the null, and the field is empty next time the form opens. Nothing fails and nothing logs.

The new spec derives its field list from what the form renders rather than hard-coding one, so a setting added without being wired up fails without anyone remembering to extend the test. It writes distinctive values before saving — saving unchanged proves little, since seven settings are empty in the test dataset and "empty survived" holds either way. Verified by removing badgeHeight from readUserVars: it fails naming the field.

Saving no longer calls GitHub every time

SettingsForm::execute() called validateRegisterFileExists() unconditionally, so every save — a badge height, a dashboard toggle — blocked on an unauthenticated GitHub request for register.csv, against a 60/hour per-IP limit. It now runs only when the organisation or repository actually changed. Verified by instrumenting the method: four saves with the register untouched make no request; changing the organisation still makes one.

Two dead settings removed

codecheckApiEndpoint and codecheckApiKey were handled in all three lifecycle methods and written on every save, but settings.tpl renders no field for either and nothing reads them. Added in db25e55 as scaffolding, never wired up.

Neither is repurposed for the one hardcoded CODECHECK endpoint (the venues list) — that deserves a name saying what it is, and there is no authenticated CODECHECK API for a key to belong to.

API routing coverage

ApiEndpoint and CodecheckRoleArray had no coverage. Tests pin down which route and method map to which handler and role set, and the recursive role flattening including the admin ⊂ edit ⊂ read nesting the handler builds.

ApiEndpoint is also made total: a method with no entries raised Undefined array key, and reading an unresolved endpoint threw Typed property … must not be accessed before initialization. That is a class-level fix, not a reachable one — OJS's own router answers routes and methods this table does not cover before the handler runs, verified against a running instance.

---

Stacked on #159. Suite: 131 PHPUnit (none skipped), 48 component, 13 e2e.