Add Psalm cross-check alongside PHPStan

[mmucklo]

Summary

Adds Psalm level 3 as a secondary static-analysis tool alongside PHPStan level 8. Both are now green.

Findings

Psalm found no genuinely new bugs that PHPStan level 8 missed. All 66 baseline entries are:

Category	Count	Status
PossiblyUnusedMethod (public API)	48	False positive — Psalm only scans src/, not test callers
PossiblyUndefinedArrayOffset	7	False positive — buildEmailAddressArray() initializes all keys
TypeDoesNotContainType / RedundantCondition	5	Duplicate of PHPStan baseline (state-machine tautologies)
UnusedFunctionCall (mb_regex_encoding)	2	Save/restore pattern; return value intentionally unused
PossiblyInvalidCast/Argument	2	str_replace return on typed-string input; false positive
MissingOverrideAttribute	1	PHP 8.3+ only; not applicable at ^8.1
InvalidScalarArgument	1	mb_regex_encoding($origEncoding) type — already guarded

Value: cross-check safety net. New code that triggers a Psalm error outside the baseline will surface during review even if PHPStan doesn't flag it.

Also

Dependabot alert #1 (PHPUnit GHSA-qrr6-mg7r-m243) dismissed as tolerable risk: dev-only dependency, vulnerability requires process-isolation mode which we don't use, fix requires PHP 8.3+ which would drop our 8.1/8.2 support.

New files

• psalm.xml — level 3, scans src/
• psalm-baseline.xml — 66 entries
• composer psalm script

Test plan

• composer ci passes (84 tests / 3,271 assertions)
• composer psalm passes with zero errors above baseline
• composer stan still passes at level 8

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.11%. Comparing base (2450702) to head (beef412).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff              @@
##             master      #56      +/-   ##
============================================
+ Coverage     92.80%   93.11%   +0.30%     
  Complexity      382      382              
============================================
  Files             6        6              
  Lines           987      987              
============================================
+ Hits            916      919       +3     
+ Misses           71       68       -3     

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.