build(gate)!: coverage leaves the gate and runs on demand

Both lanes printed a coverage total with no threshold (owner decision E32
D4). No real hit as a lane: the one time the number found anything (5 bugs,
E32) it was read by hand, and since then it was a line nobody acted on. It
was also the most expensive part of the vitest lane, and the run that
flaked in E35 S1. The vitest lane runs without --coverage, the pytest lane
runs plain pytest; docs/development.md gives both on-demand commands, and
the register row says why.

docs/development.md

@@ -75,8 +75,8 @@ python -m ruff format --check --config backend/ruff.toml backend scripts
 docker compose -f backend/docker-compose.test.yml run --rm --no-deps --build test \
   python -m basedpyright --project pyrightconfig.json
 
-# tests — pure-logic + the DB-backed integration lane, against an ephemeral Postgres, ending with the
-# coverage total. The backend tree is bind-mounted, so it always tests your working files.
+# tests — pure-logic + the DB-backed integration lane, against an ephemeral Postgres. The backend
+# tree is bind-mounted, so it always tests your working files.
 docker compose -f backend/docker-compose.test.yml up --build --abort-on-container-exit --exit-code-from test
 docker compose -f backend/docker-compose.test.yml down -v
 
@@ -103,7 +103,10 @@ npx vite build        # the production bundle (devOnlyGuard fails it on dev-only
 npm audit --omit=dev --audit-level=high   # what ships to the browser, at high or above
 ```
 
-Coverage is reported, never enforced: `npm run test -- --coverage`, and the pytest lane's last line.
+Coverage is on demand, never enforced and not in the gate (E35): `npm run test -- --coverage` in
+`frontend/`, and for the backend
+`docker compose -f backend/docker-compose.test.yml run --rm test python -m pytest --cov=app` (then
+`… down -v`).
 The Playwright suite (`npm run e2e`) runs against the `:8080` stack built from your tree; the release
 requires it. Before an image is pushed, it is scanned with Trivy (HIGH/CRITICAL with a fix fails;
 exceptions in `.trivyignore.yaml`, each with a reason and an expiry).