feat(dashboard): complete React cutover

tests/web-auth.test.ts

@@ -70,6 +70,15 @@ describe('dashboard authentication', () => {
     expect(valid.headers.get('set-cookie')).toMatch(/SameSite=Strict/);
   });
 
+  it('allows the login page to create a same-origin session under its CSP', async () => {
+    const app = express();
+    app.use(createDashboardSessionRouter('dashboard-secret'));
+
+    const response = await request(app, '/auth/login');
+
+    expect(response.headers.get('content-security-policy')).toContain("connect-src 'self'");
+  });
+
   it('does not mount debug endpoints unless explicitly enabled', async () => {
     const config = ConfigSchema.parse({
       reddit: { subreddits: ['test'] },