Write unit tests for repository and vault client

Use mocktail's `when().thenAnswer()` pattern for async Supabase calls. Create a shared `FakeSupabaseClient` helper class in `test/helpers/` that all repository tests can extend — this prevents duplication of mock wiring. For JSONB round-trip tests, store the expected JSON fixture as a `.json` file in `test/fixtures/` and load it with `rootBundle` or `File` — do not inline large JSON strings in test code. For vault RPC tests, capture the actual arguments passed to the mock using `verify(mockClient.rpc(captureAny(), params: captureAnyNamed('params')))` to assert the exact parameter shape.

Be careful with Dart null-safety: use `isNull` and `isNotNull` matchers rather than `== null` comparisons in `expect()` calls. Group tests with `group()` matching the class under test, and use `setUp()` for mock initialization.

Pure unit tests using flutter_test and mocktail. Mock the Supabase client at the lowest abstraction boundary — do not mock repository methods themselves. Test groups: (1) Repository CRUD success paths — verify correct Supabase query construction and domain object mapping; (2) Repository error mapping — inject PostgrestException with each relevant code (23505 duplicate, 42501 permission denied, PGRST116 not found) and assert the correct domain exception is thrown; (3) JSONB round-trips — serialize a fully-populated IntegrationConfig, deserialize from the mocked Supabase response, and assert field equality including nested FieldMappings; (4) Vault RPC contracts — verify storeCredential calls the correct RPC function name with expected parameters, retrieveCredential decodes the response envelope, rotateCredential invalidates old references; (5) Null-safety — test nullable fields returning null from Supabase, empty list responses, and missing optional JSONB keys. Run with `flutter test --coverage` and enforce 80% minimum via lcov threshold.