chore(ci): harden SonarCloud exclusions and CodeRabbit paths (#435)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: nanotaboada

.coderabbit.yaml

@@ -77,6 +77,28 @@ reviews:
         - Ensure error messages are descriptive
         - Verify validators are registered in DI container
 
+    - path: "src/**/Mappings/**/*.cs"
+      instructions: |
+        - Profiles should inherit from AutoMapper Profile
+        - Verify CreateMap<Source, Destination>() calls cover all DTOs in use
+        - Check reverse mappings are defined where bidirectional mapping is needed
+        - Ensure profiles are registered via AddAutoMapper() in the DI setup
+        - Flag any manual property mappings that could be replaced by convention
+
+    - path: "src/**/Middlewares/**/*.cs"
+      instructions: |
+        - Middleware must implement InvokeAsync(HttpContext context) signature
+        - Verify _next(context) is called unless the middleware intentionally short-circuits
+        - Ensure exceptions are not swallowed — rethrow or translate to Problem Details
+        - Middleware should be stateless; dependencies requiring request scope belong in services
+
+    - path: "src/**/Extensions/**/*.cs"
+      instructions: |
+        - Extension methods should target IServiceCollection and return IServiceCollection
+        - Each method should encapsulate a single registration concern
+        - Verify service lifetimes (Singleton/Scoped/Transient) match the dependency's usage
+        - Follow the Add{Feature} naming convention (e.g. AddPlayerServices, AddRateLimiting)
+
     - path: "test/**/*.cs"
       instructions: |
         - Tests should use xUnit, Moq, and FluentAssertions

sonar-project.properties

@@ -28,7 +28,8 @@ sonar.test.inclusions=test/**/*.cs
 sonar.exclusions=\
   **/obj/**,\
   **/bin/**,\
-  **/Migrations/**
+  **/Migrations/**,\
+  **/*.Designer.cs
 
 # =============================================================================
 # Coverage exclusions
@@ -39,23 +40,39 @@ sonar.exclusions=\
 sonar.coverage.exclusions=\
   test/**/*.cs,\
   **/Migrations/**,\
-  **/Data/PlayerDbContext.cs
+  **/Data/PlayerDbContext.cs,\
+  **/Program.cs
 
 # =============================================================================
 # Duplicate code (CPD) exclusions
 # NOTE: // NOSONAR suppresses rule-based issues (bugs, code smells, security
 # hotspots) but has no effect on CPD metrics. Files must be listed here to be
 # excluded from duplicate code detection.
 #
+# **/Migrations/**  — EF Core migration files are intentionally repetitive
+#   (sequential InsertData/UpdateData/Sql calls); must be listed explicitly
+#   here even though already present in sonar.exclusions, as CPD is evaluated
+#   independently of the global exclusion list.
+#
+# **/Data/PlayerDbContext.cs — scaffolded EF Core infrastructure; excluded
+#   from coverage metrics above for the same reason.
+#
 # test/**/*.cs — Fakes, Mocks, and Stubs are intentionally repetitive by
 #   design; similarity between arrange/act/assert blocks across tests is
 #   expected and harmless.
 #
+# **/Utilities/PlayerData.cs — parallel WithId/without-Id method pairs
+#   (MakeStarting11/MakeStarting11WithId, GetSubstitutes/GetSubstitutesWithId)
+#   mirror each other by design; duplication is structural, not accidental.
+#
 # **/Validators/PlayerRequestModelValidator.cs — the "Create" and "Update"
 #   rule sets share common rules by design; the duplication is intentional to
 #   keep each operation's validation self-contained and readable.
 # =============================================================================
 
 sonar.cpd.exclusions=\
+  **/Migrations/**,\
+  **/Data/PlayerDbContext.cs,\
   test/**/*.cs,\
+  **/Utilities/PlayerData.cs,\
   **/Validators/PlayerRequestModelValidator.cs