ci: publish a viewable code-coverage dashboard (Codecov badge + PR deltas)

[trinhvandat]

Problem

CI runs JaCoCo on every PR (.github/workflows/ci.yml), but the result is only uploaded
as a build artifact (jacoco-report → target/site/jacoco/). To see coverage you have
to open the Actions run, download the zip, and open index.html locally. There's no
at-a-glance dashboard, no per-PR delta, no trend over time, and no badge.

We want a coverage board we can view — ideally showing overall %, per-file/per-package
breakdown, the change a PR introduces, and a trend line as coverage climbs toward the 80%
target in CLAUDE.md.

Current overall instruction coverage: ~26% (688/2636) as of the #4 security tests, with
the JaCoCo ratchet gate still at 0.00 (see #3).

Options

Option A — Codecov (recommended)

The repo is public, so Codecov is free and gives exactly a hosted board:
codecov.io/gh/Aibles-Java/feature_flag with overall %, sunburst/grid per file, per-PR
coverage delta comments, a trend graph, and a README badge.

• Add a step to ci.yml: mvn verify already produces target/site/jacoco/jacoco.xml;
  upload it with codecov/codecov-action@v4 (files: target/site/jacoco/jacoco.xml).
• Public repos don't need a token for uploads (or add CODECOV_TOKEN as a repo secret to be safe).
• Add the coverage badge to README.md.

Option B — Publish the HTML report to GitHub Pages

Push target/site/jacoco/ to a gh-pages branch (e.g. peaceiris/actions-gh-pages) so the
full JaCoCo HTML report is browsable at a stable URL. Self-hosted, no third party — but no
per-PR delta or trend unless we build it ourselves.

Option C — GitHub Actions job summary (lightest)

Write a coverage table to $GITHUB_STEP_SUMMARY (parse jacoco.csv) so each run's summary
page shows the numbers inline. Zero external deps, but no persistent board/trend and no badge.

Proposed scope

• Go with Option A (Codecov) as the primary "board"; optionally add Option C so the
  number is also visible on the run summary without leaving GitHub.
• Wire the upload into ci.yml after verify, add the badge to README.md, and confirm the
  first PR comment renders.
• Keep the existing artifact upload as a fallback.

Acceptance criteria

• A public coverage dashboard exists and updates on every push to develop/main.
• PRs into develop get an automated coverage-delta comment.
• README.md shows a live coverage badge.
• No secrets committed; any token stored as a GitHub Actions secret.

Notes

Independent of the coverage gate (#3) — this is about visibility, not enforcement.
Once a trend is visible we can revisit ratcheting jacoco.line.coverage upward.

[trinhvandat]

🧑‍⚖️ Decision (human-in-the-loop)
Q: Which coverage dashboard should back the viewable board (and merge blocking)?
Options: Codecov (issue's Option A) / SonarQube Cloud / self-hosted SonarQube
Chosen: self-hosted SonarQube — team wants the quality gate to block merges and prefers self-hosting; the SonarQube server infra will live in a separate repository, this repo only wires CI analysis + gate against it.