Block stray HTTP requests in the Feature test suite

Feature tests could silently make real outbound HTTP requests when a code path
was not covered by an Http::fake(), which is slow, flaky and network-dependent
in CI. Adds a Feature-scoped beforeEach that calls Http::preventStrayRequests()
so any unfaked request fails loudly instead. Tests that legitimately talk to
external services register their own fakes, which take precedence.

Ran a representative HTTP-touching subset with the guard active (open banking,
exchange-rate/currency conversion, AI categorization and AI/stats reports,
analytics, Discord and Stripe webhooks, bank-logo commands): no test relied on
an unfaked real request, so no fakes had to be added.

Adds StrayHttpRequestGuardTest to lock the behavior: an unfaked request throws
StrayRequestException while a matched fake still resolves.

tests/Feature/StrayHttpRequestGuardTest.php

@@ -0,0 +1,16 @@
+<?php
+
+use Illuminate\Http\Client\StrayRequestException;
+use Illuminate\Support\Facades\Http;
+
+test('an unfaked outbound HTTP request is blocked in the Feature suite', function () {
+    Http::get('https://example.com/should-not-be-called');
+})->throws(StrayRequestException::class);
+
+test('a faked request still goes through when a matching fake is registered', function () {
+    Http::fake(['example.com/*' => Http::response(['ok' => true])]);
+
+    $response = Http::get('https://example.com/allowed');
+
+    expect($response->json('ok'))->toBeTrue();
+});

tests/Pest.php

@@ -14,6 +14,7 @@ use App\Services\Banking\Sync\BankingConnectionSyncerFactory;
 use App\Services\Banking\TransactionSyncService;
 use Illuminate\Foundation\Testing\RefreshDatabase;
 use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Http;
 use Stripe\Collection as StripeCollection;
 use Stripe\Service\SubscriptionService;
 use Stripe\StripeClient;
@@ -52,6 +53,20 @@ pest()->beforeEach(function () {
     $this->withoutVite();
 })->in('Feature', 'Performance');
 
+/*
+|--------------------------------------------------------------------------
+| Block stray HTTP requests in Feature tests
+|--------------------------------------------------------------------------
+|
+| Any Feature test whose code path hits the network without a matching
+| Http::fake() should fail loudly instead of making a real request. Tests
+| that legitimately talk to external services register their own fakes,
+| which take precedence over this guard.
+*/
+pest()->beforeEach(function () {
+    Http::preventStrayRequests();
+})->in('Feature');
+
 /*
 |--------------------------------------------------------------------------
 | Expectations