Fix SonarQube/PHPStan issues: session type, returns count, coverage gaps

- AuditLog: move @var before ORM attribute for PHPStan visibility
- SubAccountPermissionSubscriber: use Session instead of FlashBagAwareSessionInterface
- SuspendedUserSubscriber: same Session type fix
- OrderController::create: merge expired + invalid cart into single return (4→3 returns)
- OrderControllerTest: add testCreateOrderUnlimitedBillet (covers clampQuantity unlimited branch)
- AccountControllerTest: add BilletOrder in soldCounts test (covers foreach $rows loop)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/Controller/AccountControllerTest.php

@@ -2108,6 +2108,13 @@ class AccountControllerTest extends WebTestCase
         $item->setUnitPriceHT(1000);
         $order->addItem($item);
         $em->persist($order);
+
+        $ticket = new \App\Entity\BilletOrder();
+        $ticket->setBilletBuyer($order);
+        $ticket->setBillet($billet);
+        $ticket->setBilletName('Entree');
+        $ticket->setUnitPriceHT(1000);
+        $em->persist($ticket);
         $em->flush();
 
         $client->loginUser($user);

tests/Controller/OrderControllerTest.php

@@ -208,6 +208,31 @@ class OrderControllerTest extends WebTestCase
         self::assertStringContainsString('/informations', $data['redirect']);
     }
 
+    public function testCreateOrderUnlimitedBillet(): void
+    {
+        $client = static::createClient();
+        $em = static::getContainer()->get(EntityManagerInterface::class);
+        $user = $this->createOrga($em);
+        [$event] = $this->createEventWithBillet($em, $user);
+
+        $category = $em->getRepository(Category::class)->findOneBy(['event' => $event]);
+        $unlimited = new Billet();
+        $unlimited->setName('Illimite');
+        $unlimited->setCategory($category);
+        $unlimited->setPriceHT(500);
+        $unlimited->setQuantity(null);
+        $em->persist($unlimited);
+        $em->flush();
+
+        $client->request('POST', '/evenement/'.$event->getId().'/commander', [], [], ['CONTENT_TYPE' => 'application/json'], json_encode([
+            ['billetId' => $unlimited->getId(), 'qty' => 50],
+        ]));
+
+        self::assertResponseIsSuccessful();
+        $data = json_decode($client->getResponse()->getContent(), true);
+        self::assertStringContainsString('/informations', $data['redirect']);
+    }
+
     // === GUEST ===
 
     public function testGuestPageNotFound(): void