feat(dashboard): complete React cutover

tests/dashboard-assets.test.ts

@@ -11,17 +11,14 @@ describe('resolveDashboardAssets', () => {
     expect(resolveDashboardAssets(workspace, fileExists)).toEqual({
       directory: path.dirname(reactIndex),
       indexFile: reactIndex,
-      isLegacy: false,
     });
   });
 
-  it('falls back to the legacy dashboard during incremental migration', () => {
+  it('fails clearly when the production React build is missing', () => {
     const workspace = path.resolve('workspace');
 
-    expect(resolveDashboardAssets(workspace, () => false)).toEqual({
-      directory: path.join(workspace, 'public'),
-      indexFile: path.join(workspace, 'public', 'index.html'),
-      isLegacy: true,
-    });
+    expect(() => resolveDashboardAssets(workspace, () => false)).toThrow(
+      'React dashboard build is missing',
+    );
   });
 });

tests/dashboard-login-banner.test.ts

@@ -1,16 +0,0 @@
-import fs from 'node:fs';
-import path from 'node:path';
-import { describe, expect, it } from 'vitest';
-
-describe('dashboard Reddit session banner', () => {
-  it('renders a persistent recovery banner with a Reddit login action', () => {
-    const html = fs.readFileSync(path.resolve('public/index.html'), 'utf8');
-
-    expect(html).toContain('id="reddit-session-banner"');
-    expect(html).toContain('id="reddit-session-banner-title"');
-    expect(html).toContain('Open Reddit Login');
-    expect(html).toContain("data.status === 'unreachable'");
-    expect(html).toContain("data.status === 'login-required'");
-    expect(html).toContain('info.publicUrl');
-  });
-});

tests/web-auth-cutover.test.ts

@@ -110,10 +110,4 @@ describe('authenticated React dashboard cutover', () => {
     expect(upload.status).toBe(404);
   });
 
-  it('uses the legacy dashboard only when a React build is absent', async () => {
-    const running = await startServer({ includeReactBuild: false });
-    runningServers.push(running);
-    const response = await fetch(running.baseUrl, { headers: { Authorization: `Bearer ${AUTH_TOKEN}` } });
-    expect(await response.text()).toContain('Legacy dashboard');
-  });
 });

tests/web-auth.test.ts

@@ -70,6 +70,15 @@ describe('dashboard authentication', () => {
     expect(valid.headers.get('set-cookie')).toMatch(/SameSite=Strict/);
   });
 
+  it('allows the login page to create a same-origin session under its CSP', async () => {
+    const app = express();
+    app.use(createDashboardSessionRouter('dashboard-secret'));
+
+    const response = await request(app, '/auth/login');
+
+    expect(response.headers.get('content-security-policy')).toContain("connect-src 'self'");
+  });
+
   it('does not mount debug endpoints unless explicitly enabled', async () => {
     const config = ConfigSchema.parse({
       reddit: { subreddits: ['test'] },