feat: secure React dashboard cutover

tests/dashboard-token-config.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it } from 'vitest';
+import { ConfigSchema } from '../src/config/index.js';
+
+describe('dashboard token configuration', () => {
+  it('accepts an eight-character local dashboard token', () => {
+    const result = ConfigSchema.safeParse({
+      reddit: { subreddits: ['test'] },
+      openrouter: {
+        apiKey: 'test-key',
+        imageAnalysisPrompt: 'test',
+        messageGenerationPrompt: 'test',
+      },
+      web: { enabled: true, authToken: 'create01' },
+    });
+
+    expect(result.success).toBe(true);
+  });
+
+  it('still rejects trivially short dashboard tokens', () => {
+    const result = ConfigSchema.safeParse({
+      reddit: { subreddits: ['test'] },
+      openrouter: {
+        apiKey: 'test-key',
+        imageAnalysisPrompt: 'test',
+        messageGenerationPrompt: 'test',
+      },
+      web: { enabled: true, authToken: 'short' },
+    });
+
+    expect(result.success).toBe(false);
+  });
+});