fix gitlab tests

docs/alrahma_end_to_end_use_case_test_plan.md

@@ -2585,3 +2585,21 @@ New coverage areas:
 - Batch 20 continuity/compliance risk register and regression sweep.
 
 This batch is meant to catch the quiet business-rule failures: the payment that balances only because the client said so, the grade changed after lock, the export that includes medical notes, the badge scan that trusts a header, and the emergency broadcast that ignores consent. Tiny details, enormous blast radius.
+
+## Batch 20 CI Failure Remediation Patch
+
+This patch addresses the first GitLab failures observed after the Batch 20 full-surface suite started executing in CI.
+
+Applied fixes:
+
+- Switched GitLab PHPUnit execution from SQLite to a MySQL service so MySQL-specific production queries such as `GROUP_CONCAT(... ORDER BY ... SEPARATOR ...)` run against the same SQL dialect they were written for.
+- Updated `phpunit.xml` DB defaults to MySQL for CI parity and replaced the invalid APP_KEY with a valid AES-256-CBC testing key.
+- Hardened `POST /api/v1/students` validation so required non-null database fields fail with 422 instead of falling through to database constraint errors.
+- Split student creation payloads from first-child emergency-contact payloads so parent/contact fields are no longer sent into `Student::create()`.
+- Added a `stats` table migration and guarded stats controllers so stats endpoints do not 500 in empty/test databases.
+- Normalized refund overpayment invoice rows with `toArray()` and defensive ID checks to remove `Undefined array key "id"` failures.
+- Made manual payment record/edit failures return controlled 4xx responses instead of bubbling domain exceptions into 5xx responses.
+- Tightened full-surface student payload generation so student probes include required fields such as age, photo consent, registration year, and activation flags.
+- Documented intentional legacy/unversioned compatibility routes in the versioning contract allow-list.
+
+The goal of this remediation is not to weaken the broad test net. It removes environmental mismatches and real application crashes so the next CI run exposes the next layer of actual behavior failures.