Fix local web issues and update dependencies

[definitelynotguru]

Summary

• fix local note pinning, archiving, persistence, empty states, and /notes/new and /notes/daily aliases
• improve anonymous auth handling while preserving refresh-cookie session recovery
• add installable PWA assets, offline fallback, local-only disclosure, preview titles, and a custom 404 page
• update supported web, Android, Gradle, and GitHub Actions dependencies and resolve Knip, Spotless, and npm audit findings
• remove Dependabot configuration and document manual dependency maintenance
• add Playwright coverage for local note persistence, aliases, and anonymous refresh behavior

Validation

• npm test
• npm run lint
• npm run format:check
• npm run knip
• npm audit
• npm run build
• npx playwright test e2e/local-notes.spec.ts
• ./gradlew :app:testDebugUnitTest
• ./gradlew spotlessCheck
• ./gradlew detekt
• ./gradlew :app:lintDebug
• ./gradlew :app:compileDebugAndroidTestKotlin
• ./gradlew :app:assembleDebug

Fixes #130

PR Agent Description

PR Type

Bug fix, Enhancement, Other

Description

• The change makes POST /api/v1/auth/refresh return 204 when no refresh token exists (web/src/app/api/v1/auth/refresh/route.ts); web/src/lib/api-client.ts treats 204 as anonymous and docs/openapi.yaml documents the 204 case.
• web/src/lib/api-client.ts makes tokenExpiresWithinMinutes internal and web/src/components/AuthProvider.tsx checks cached user before redirect to avoid session_expired for anonymous users.
• web/src/lib/local-notes.ts sorts pinned notes first by pinned_at then updated_at, switches put/delete/clear to tx.oncomplete/onabort, removes countLocalNotes, and hides openLocalDB.
• Several web libs narrow public API: web/src/lib/api-utils.ts hides getAuthUser and REFRESH_COOKIE, revisions.ts hides limits and helpers, wiki-links.ts and export-markdown.ts hide types, backup-import-server.ts hides validateBackupBundle.
• PWA updates bump cache to recall-v3 and add OFFLINE_URL fallback in web/public/sw.js, precache new PNG icons and manifest.webmanifest, update web/public/manifest.json and web/src/app/layout.tsx, and add web/public/offline.html and web/src/app/not-found.tsx.
• CI removes .github/dependabot.yml, notes manual dependency updates in AGENTS.md, and bumps workflows (build-apk, db-push, deploy-web, secret-scan, web-test) to checkout@v7, setup-java@v5, setup-android@v4, upload-artifact@v7.
• Android updates Gradle wrapper (gradle-wrapper.jar/properties, gradlew) and build files, and applies repository-wide Spotless/ktlint/Prettier reformatting across ~60 Kotlin files and web code; reviewers should hide whitespace.
• Tests cover new behavior: web/src/lib/api-client.test.ts asserts 204 means anonymous, web/e2e/local-notes.spec.ts adds local-notes flow, and backup/markdown and reminder tests change only for formatting.

Changes Diagram

flowchart LR
  A["Client refresh request"] --> B["Server returns 204 if no token"]
  B --> C["api-client treats 204 as anonymous"]
  C --> D["AuthProvider conditional redirect"]
  D --> E["local-notes pinned sort and IDB tx"]
  E --> F["PWA SW recall-v3 and offline page"]
  F --> G["CI workflow bumps and formatting pass"]

Loading

Review map

1. web/src/app/api/v1/auth/refresh/route.ts: Auth now returns 204 for anonymous — verify contract change
2. web/src/lib/api-client.ts: Client handles 204 and hides expiry helper — check error flow
3. web/src/lib/local-notes.ts: Pinned sort and IDB transaction handling changed
4. web/src/components/AuthProvider.tsx: Conditional session_expired redirect — verify UX risk
5. web/public/sw.js: Service worker cache v3 and offline fallback — check PWA install

[zeus-review]

PR Agent Review

Note

• The PR hardens refresh and session expiry, offline storage, PWA shell and Android sync.
• It changes anonymous refresh to 204, tightens token expiry checks and serializes sync with a mutex.
• It updates the service worker to version 3 and precaches offline assets with shared cache logic.
• AuthProvider bootstraps with refresh, then loads the user and handles offline and interval refresh.
• Api-client checks token expiry within five minutes and shares the refresh promise across requests.
• SyncRepository locks sync, reuses deviceId and updates sync metadata after poll and merge.
• IndexedDB helpers guard open, blocked and transaction errors and preserve pinned sort order.
• Review coverage is partial because the correctness specialist did not complete, so verify logic manually.

Size	XXL
P1 · c4	Add concurrent sync Mutex test for deviceId flap On the diff · android/app/src/main/java/com/notesreminders/app/sync/SyncRepository.kt · lines 34-40 Fix prompt on the inline thread.
P1 · c4	Test bootstrap 204 clears stale cached user Summary only · web/src/components/AuthProvider.tsx · lines 42-58 AuthProvider bootstrap clears cached user when refreshAccessToken returns null (204 anonymous). Tests cover anonymous without cache and offline exception that retains cache, but no test saves a cached user then bootstraps with 204. Without it a regression that skips clearCachedUser leaves stale offline UI. Expand Prompt to fix below (summary-only).
P2 · c4	knip ignore not widened for .tsx tests Summary only · web/knip.json · lines 11-20 vitest.config was widened to src/**/*.test.{ts,tsx} to include AuthProvider.test.tsx, but knip.json still ignores only src/**/*.test.ts. The new .tsx test is not ignored, so knip treats it as source project code. The two configs drifted in this PR. Expand Prompt to fix below (summary-only).
P2 · c4	Test install caches.open rejection still skipWaits On the diff · web/public/sw.js · lines 15-22 Fix prompt on the inline thread.
P2 · c4	Pin token expiry exact 5-min boundary On the diff · web/src/lib/api-client.ts · lines 48-52 Fix prompt on the inline thread.
Relevant tests	partial
Security	null
CI	✅ All CI is passing

Coverage partial: correctness specialist failed.

Prompt to fix — P1 · Test bootstrap 204 clears stale cached user

Add jsdom test: saveCachedUser({id,email}), mock refreshAccessToken to null, render AuthProvider, wait for anonymous status, assert loadCachedUser() is null and localStorage has no cached user.

Prompt to fix — P2 · knip ignore not widened for .tsx tests

Change knip ignore from "src/**/*.test.ts" to "src/**/*.test.{ts,tsx}" to match vitest include and coverage exclude.

Fix all findings (agent prompt)

Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, and keep changes minimal.

Repository: definitelynotguru/Recall
Pull request: #131
Head SHA: e84087ef46f3c353521a270957e7f8dee0cfa6fe

Findings:

[P1] @android/app/src/main/java/com/notesreminders/app/sync/SyncRepository.kt lines 34-40
Add test with in-memory Room and fake NotesApi that suspends pollSync. Launch two async { repo.sync() } under runTest, release poll, then assert SyncMetaDao.get() upserted once and both sync requests used the same device_id.

[P1] @web/src/components/AuthProvider.tsx lines 42-58
Add jsdom test: saveCachedUser({id,email}), mock refreshAccessToken to null, render AuthProvider, wait for anonymous status, assert loadCachedUser() is null and localStorage has no cached user.
[inline thread omitted — summary only]

[P2] @web/knip.json lines 11-20
Change knip ignore from "src/**/*.test.ts" to "src/**/*.test.{ts,tsx}" to match vitest include and coverage exclude.
[inline thread omitted — summary only]

[P2] @web/public/sw.js lines 15-22
Add test: loadServiceWorker with caches.open mocked to reject, trigger install waitUntil, await completion, assert worker.skipWaiting called once.

[P2] @web/src/lib/api-client.ts lines 48-52
Add jsdom test: mock Date.now to 1_700_000_000_000, set token at exp = now/1000+300, assert ensureFreshAccessToken does not fetch; at 299 and -60 assert it does fetch. Use existing jwt helper.

<ci_summary untrusted="true">
✅ All CI is passing
</ci_summary>

See the review map in the PR description.

_{e84087e ⋅ general ⋅ 25m 26s ⋅ meta/muse-spark-1.2-contributor}

[zeus-review]

Note

Track this run on the progress stub in the PR conversation.

tests Here's what the tests found.

[zeus-review]

Note

Track this run on the progress stub in the PR conversation.

quality Here's what the quality found.

[zeus-review]

Note

Track this run on the progress stub in the PR conversation.

correctness Here's what the correctness found.

[definitelynotguru]

/review

[zeus-review]

Note

Track this run on the progress stub in the PR conversation.

quality Here's what the quality found.

[zeus-review]

Note

Track this run on the progress stub in the PR conversation.

tests Here's what the tests found.

[definitelynotguru]

/review

[zeus-review]

Note

Track this run on the progress stub in the PR conversation.

tests Here's what the tests found.

[zeus-review]

Note

Track this run on the progress stub in the PR conversation.

tests Here's what the tests found.

[zeus-review]

Note

Track this run on the progress stub in the PR conversation.

quality Here's what the quality found.

[definitelynotguru]

/review

[zeus-review]

Note

Track this run on the progress stub in the PR conversation.

tests Here's what the tests found.

[zeus-review]

Note

Track this run on the progress stub in the PR conversation.

correctness Here's what the correctness found.

[definitelynotguru]

/review

[zeus-review]

Note

Track this run on the progress stub in the PR conversation.

tests Here's what the tests found.

[definitelynotguru]

/review

[zeus-review]

Note

Track this run on the progress stub in the PR conversation.

tests Here's what the tests found.

[zeus-review]

Note

Track this run on the progress stub in the PR conversation.

quality Here's what the quality found.

[zeus-review]

Note

Track this run on the progress stub in the PR conversation.

correctness Here's what the correctness found.

[definitelynotguru]

/review

[zeus-review]

Note

Track this run on the progress stub in the PR conversation.

tests Here's what the tests found.