feat(test): hermetic hub fake + state-matrix sweep across all pages

The widget suites used to talk to whatever listens on the real
endpoint — results depended on the operator's machine (a running
hub fed real data into a11y/responsive runs and its gRPC channel
timers caused the historic flake). Hardening round:

- HubService.instance is now injectable (debugSetInstance);
  FakeHubService (test/support/fake_hub.dart) answers every member
  the pages touch with healthy-empty defaults and scripts per-RPC
  failures (UNIMPLEMENTED / UNAVAILABLE / detached gate) through a
  GrpcError-shaped fake. Unimplemented members are recorded and
  fail the sweep with the exact list.
- state_matrix_test.dart pins the app-wide invariants for every
  sidebar page x hub condition: healthy => no unreachable claims
  and no raw error text; hub gone => honest unreachable states;
  UNIMPLEMENTED => never 'not reachable' while the sidebar shows
  connected; detached gate => plain-language feature-off state.
- a11y + responsive sweeps now inject the fake (hermetic); the
  6-minute idle-timer drain workaround is gone with the cause.

Real bugs the new sweep caught immediately:
- every data page (store, doctor, audit, approvals, federation)
  folded ANY load failure into 'hub not reachable' — the runs-page
  bug class; they now share HubLoadErrorView, which classifies
  into unreachable / needs-newer-hub / load-failed-with-copyable-
  detail (new generic DE+EN strings)
- the approvals page's hidden tab had no future listener: a load
  failure there surfaced as an uncaught async error
- the audit status bar rendered the raw gRPC error wall verbatim;
  it now shows the classified friendly headline (still selectable)

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

test/a11y_test.dart

@@ -24,6 +24,8 @@ import 'package:shared_preferences/shared_preferences.dart';
 import 'package:chain_studio/data/hub.dart';
 import 'package:chain_studio/main.dart';
 
+import 'support/fake_hub.dart';
+
 const _destinations = <String>[
   'welcome',
   'store',
@@ -40,6 +42,11 @@ void main() {
     testWidgets('all pages meet a11y guidelines — ${mode.name}',
         (tester) async {
       SharedPreferences.setMockInitialValues({});
+      // Hermetic: pages render against the scriptable fake, never a
+      // hub that happens to listen on the operator's machine (the
+      // suite's historic pending-timer flake came from real gRPC
+      // channels arming their 5-minute idle timer mid-test).
+      installFakeHub();
       // Layout correctness across sizes is responsive_test.dart's
       // job; this suite audits colors and labels at a normal size.
       tester.view.physicalSize = const Size(1280, 800);
@@ -88,19 +95,6 @@ void main() {
       // !timersPending after the test body.
       await tester.pumpWidget(const SizedBox.shrink());
       await tester.pump(const Duration(minutes: 1));
-      // The suite's long-standing pending-timer flake, finally
-      // caught with a creation stack: when the last gRPC stream
-      // closes, Http2ClientConnection._handleActiveStateChanged
-      // arms the channel's 5-minute idleTimeout timer — even on a
-      // shut-down connection — so a 1-minute drain never covered
-      // it. Close the channel in real-async space (lets in-flight
-      // socket callbacks land), then pump PAST the idle timeout so
-      // the timer fires inside the test body.
-      await tester.runAsync(() async {
-        HubService.instance.debugResetChannel();
-        await Future<void>.delayed(const Duration(milliseconds: 100));
-      });
-      await tester.pump(const Duration(minutes: 6));
       expect(
         violations,
         isEmpty,