Add Codecov coverage tracking for backend tests

[devin-ai-integration]

Summary

Implements Codecov integration to track backend test coverage trends over time. This PR modifies the GitHub Actions backend workflow to generate coverage reports during pytest runs and upload them to Codecov, plus adds a coverage badge to the README.

Changes:

• Modified .github/workflows/backend.yml to run pytest with --cov=xfd_api flags and generate XML coverage reports
• Added codecov/codecov-action@v4 step to upload coverage data
• Added Codecov badge to README.md
• Added pytest-cov==6.0.0 to backend/requirements.txt for coverage support
• Restored makemigrations call before pytest to match original Makefile behavior

Updates since last revision

• Added pytest-cov==6.0.0 to backend/requirements.txt to fix CI failure (pytest was not recognizing --cov flags)
• Added python manage.py makemigrations step before pytest to preserve original test setup behavior from the Makefile

Review & Testing Checklist for Human

• Add CODECOV_TOKEN secret to GitHub repository settings after connecting the repo to Codecov at codecov.io
• Verify coverage.xml path: Confirm that pytest generates coverage.xml at /app/coverage.xml inside the container
• Note: The frontend CI job is failing due to pre-existing npm audit vulnerabilities (glob, js-yaml) unrelated to this PR

Test Plan

1. Sign up/login to codecov.io and connect the COG-GTM/DHS-CISA-XFD repository
2. Copy the Codecov upload token and add it as CODECOV_TOKEN in GitHub repository secrets
3. Merge this PR and push a change to trigger the backend workflow
4. Verify the coverage report appears on the Codecov dashboard
5. Confirm the README badge displays the coverage percentage

Notes

• fail_ci_if_error: false is set so CI won't fail if Codecov upload has issues (e.g., token not configured yet)
• Coverage is flagged as backend to distinguish from potential future frontend coverage
• pytest-cov==6.0.0 was added to requirements.txt since the backend Docker image did not have it installed

Link to Devin run: https://app.devin.ai/sessions/694417ee8a9d47a6bac32021eebf0751
Requested by: Jake Cosme (@jakexcosme)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring