test: force APP_ENV=testing in \$_SERVER too (fix 9 local test failures)

Root cause: shell APP_ENV=development leaks into \$_SERVER via PHP's
variables_order=EGPCS. phpunit.xml <env force> sets \$_ENV + putenv()
but NOT \$_SERVER. Dotenv's RepositoryBuilder default adapter order
puts ServerConstAdapter before EnvConstAdapter — so \$_SERVER wins.

Consequences when env() returns 'development' during tests:
- runningUnitTests() = false (checks app['env'] === 'testing')
- PreventRequestForgery middleware doesn't bypass → POST/PUT → 419
  (6 RegistrationTest failures + 1 UserTest profile update failure)
- Filament/Livewire panel behaviour differs → fillForm validation
  fires on stale state (2 Flight resource tests)

Fix: also force \$_SERVER['APP_ENV']='testing' via <server> directive.
PHPUnit treats <server> + <env> as separate superglobals.

Local: 460/9 → 471/0 (no other changes). CI unaffected (CI shell
doesn't export APP_ENV so \$_SERVER was already empty).

phpunit.xml

@@ -25,6 +25,7 @@
         </include>
     </source>
     <php>
+        <server name="APP_ENV" value="testing" force="true"/>
         <env name="APP_ENV" value="testing" force="true"/>
         <env name="APP_MAINTENANCE_DRIVER" value="file" force="true"/>
         <env name="BCRYPT_ROUNDS" value="4" force="true"/>