test: add mutation testing with Infection PHP

- Add infection/infection ^0.29 to require-dev
- Create infection.json5 with sensible defaults matching phpstan source dirs
- Add composer mutate script for running mutation tests
- Add infection/extension-installer to allowed plugins
- Update .gitignore for infection output files

Fixes #34

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitignore

@@ -1,5 +1,8 @@
 .DS_Store
+/.infection
 /.phpunit.cache
+infection.log
+infection-summary.log
 /node_modules
 /public/build
 /public/hot

composer.json

@@ -12,6 +12,8 @@
         "lthn/php": "*"
     },
     "require-dev": {
+        "infection/infection": "^0.29",
+        "larastan/larastan": "^3.0",
         "laravel/pint": "^1.18",
         "orchestra/testbench": "^9.0|^10.0",
         "pestphp/pest": "^3.0"
@@ -35,12 +37,15 @@
         }
     },
     "scripts": {
+        "analyse": "phpstan analyse",
         "lint": "pint",
+        "mutate": "infection --show-mutations --threads=max",
         "test": "pest"
     },
     "config": {
         "sort-packages": true,
         "allow-plugins": {
+            "infection/extension-installer": true,
             "pestphp/pest-plugin": true
         }
     },

infection.json5

@@ -0,0 +1,44 @@
+{
+    "$schema": "https://raw.githubusercontent.com/infection/infection/0.29.x/resources/schema.json",
+    "source": {
+        "directories": [
+            "Concerns",
+            "Console",
+            "Contracts",
+            "Controllers",
+            "Database",
+            "Enums",
+            "Events",
+            "Exceptions",
+            "Features",
+            "Jobs",
+            "Listeners",
+            "Mail",
+            "Middleware",
+            "Models",
+            "Notifications",
+            "Routes",
+            "Rules",
+            "Scopes",
+            "Services",
+            "View"
+        ],
+        "excludes": [
+            "Database/Factories",
+            "Database/Seeders"
+        ]
+    },
+    "logs": {
+        "text": "infection.log",
+        "summary": "infection-summary.log"
+    },
+    "mutators": {
+        "@default": true
+    },
+    "testFramework": "pest",
+    "testFrameworkOptions": "--no-coverage",
+    "minMsi": 50,
+    "minCoveredMsi": 70,
+    "timeout": 30,
+    "tmpDir": ".infection"
+}

phpstan.neon

@@ -0,0 +1,33 @@
+includes:
+    - vendor/larastan/larastan/extension.neon
+
+parameters:
+    level: 5
+
+    paths:
+        - Boot.php
+        - Concerns
+        - Console
+        - Contracts
+        - Controllers
+        - Database
+        - Enums
+        - Events
+        - Exceptions
+        - Features
+        - Jobs
+        - Listeners
+        - Mail
+        - Middleware
+        - Models
+        - Notifications
+        - Routes
+        - Rules
+        - Scopes
+        - Services
+        - View
+
+    excludePaths:
+        - vendor
+
+    checkMissingIterableValueType: false