ci: make Codecov patch status blocking

codecov.yml

@@ -1,14 +1,26 @@
 # Paths excluded from Codecov totals (demo hosts).
 # Plain folder paths only (Codecov treats entries as regex; avoid ** bombs).
 # Upload token stays in GitHub Actions secrets, not here.
+#
+# Patch must be blocking (not informational). Project uses `auto` so pre-existing
+# misses do not fail every PR; new lines still need 100% patch coverage.
+codecov:
+  require_ci_to_pass: true
+  notify:
+    wait_for_ci: true
+
 coverage:
   status:
     project:
       default:
-        informational: true
+        target: auto
+        threshold: 0%
+        informational: false
     patch:
       default:
-        informational: true
+        target: 100%
+        threshold: 0%
+        informational: false
 
 ignore:
   - "demo-leptos"