test(form-manager): improve Form_Manager test coverage

[superdav42]

Task t465\n\nImprove test coverage for Form_Manager (inc/managers/class-form-manager.php).\n\nCurrent coverage: 9.7% (251 uncovered statements)\nEstimated effort: ~3h\n\n## Acceptance Criteria\n- PHPUnit tests added for Form_Manager\n- Coverage increases to ≥60%\n- All tests pass in CI

[superdav42]

What was done

• Added 3 new PHPUnit tests to Form_Manager_Test.php covering previously untested code paths
• test_security_checks_dies_for_non_ajax_request: covers security_checks() wp_die(0) path when HTTP_X_REQUESTED_WITH is absent
• test_security_checks_passes_for_valid_ajax_request: covers security_checks() pass-through with valid AJAX context, registered form, and capable user
• test_default_bulk_action_handler_sends_error_when_process_fails: covers wp_send_json_error() path in default_bulk_action_handler() when process_bulk_action() returns WP_Error

Testing Evidence

• Testing level: unit-tested
• Risk classification: Low (test files only, no production code modified)
• All 43 Form_Manager tests pass: OK (43 tests, 94 assertions)
• Coverage: Methods 56.25% → 62.50% (10/16), Lines 79.06% → 81.23% (225/277)

Key decisions

• display_form_unavailable(), display_form(), and handle_form() remain untested — all terminate with bare die/exit (not wp_die()), making them untestable without process isolation. This is documented in test file comments.
• Used wp_die_handler filter (not wp_die_ajax_handler) for security_checks() since it calls wp_die(0) in non-AJAX context

Files changed

• tests/WP_Ultimo/Managers/Form_Manager_Test.php — added 119 lines (3 new test methods + section header)

Blockers

• None

Follow-up needs

• PR t495: fix(tests): refactor test_handle_model_delete_form_requires_confirmation to use call_in_ajax_context() helper #563 (bugfix/form-manager-exit-fix) is still open — it refactors test_handle_model_delete_form_requires_confirmation to use call_in_ajax_context() helper. That cleanup is independent of this coverage task.