Add isHidden to Category, category CRUD tests, coverage improvements

- Add isHidden field to Category entity with migration (DEFAULT false for existing rows)
- Add isHidden checkbox to edit category template and "Masquee" badge on category list
- Save isHidden in editCategory controller method
- Fix Category.isActive() indentation
- Create CategoryTest with full coverage (14 tests): defaults, setters, setEvent logic, isActive, isHidden
- Add category CRUD tests to AccountControllerTest: add/edit/delete/reorder categories with access control
- Add cookie-consent tests for dev env early return and Cloudflare tunnel script
- Exclude PayoutPdfService from phpunit coverage and SonarQube analysis

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

tests/js/cookie-consent.test.js

@@ -91,4 +91,28 @@ describe('initCookieConsent', () => {
         const script = document.querySelector('script[data-analytics]')
         expect(script).not.toBeNull()
     })
+
+    it('does not load analytics in dev environment', () => {
+        document.body.dataset.env = 'dev'
+        document.cookie = 'e_ticket_consent=accepted;path=/'
+        initCookieConsent()
+        const script = document.querySelector('script[data-analytics]')
+        expect(script).toBeNull()
+    })
+
+    it('loads cloudflare tunnel script on accept', () => {
+        initCookieConsent()
+        document.getElementById('cookie-accept').click()
+        const script = document.querySelector('script[data-cf-beacon]')
+        expect(script).not.toBeNull()
+        expect(script.src).toContain('/assets/perf.js')
+    })
+
+    it('does not duplicate cloudflare script', () => {
+        document.cookie = 'e_ticket_consent=accepted;path=/'
+        initCookieConsent()
+        initCookieConsent()
+        const scripts = document.querySelectorAll('script[data-cf-beacon]')
+        expect(scripts.length).toBe(1)
+    })
 })