test: pin custom-header coverage on every outbound API call

[dgjlindsay]

Audit of every outbound call to the API for custom-header coverage, plus tests to keep it that way.

The header table exists so a merchant can clear their own firewall; a call
site that skips it is blocked by that same firewall on that one request.

Audit found no gap — every server-side call routes through
Service\Api\Adapter, which merges the configured rows unconditionally,
including the pre-auth API-key verification call. Two tests close the
coverage hole rather than a behaviour one:

• the API-key verification call (unsaved candidate key) is now pinned to
  carry the configured headers, not just the right key
• the build fails if a production class builds its own HTTP client instead
  of going through the adapter

The one non-adapter client is the invoice PUT to a signed Cloud Storage URL,
whose headers are fixed by the signature; it is named as an exception.

[claude]

Test-only PR (no production code changes). Verified the new execute() call in AdapterTest matches the real method signature ($endpoint, $payload, $method, $storeId, $apiKeyOverride), and the new OutboundCallSiteCoverageTest file-sweep correctly reaches the module sources with a reasonable named-exception list for the signed-URL upload path. No critical issues found.

Ready for human approval ✅

[dgjlindsay]

Adversarial review: ran both test files against the real PR branch (phpunit 10.5.64, no vendor/ needed thanks to the bootstrap stubs).

• OutboundCallSiteCoverageTest: verified the exception list (Adapter.php, Invoice/UploadService.php) matches the actual grep result for the marker set — not a coincidental pass. Mutation test: added a throwaway file calling curl_init() outside the exception list → test correctly failed and named the new file.
• AdapterTest::testTheApiKeyVerificationCallCarriesTheConfiguredHeaders: confirmed it exercises a genuinely new combination (apiKeyOverride + configured custom headers on the verify_api_key path) not covered by the existing dataProvider tests. Mutation test: gated the custom-header merge loop on apiKeyOverride === null (simulating a bypass bug) → test correctly failed.

Full suite: 27/27 passing, no vacuous assertions found. No changes needed.

by Claude