test: expand e2e and credential coverage

[orangeboyChen]

Summary

This PR adds a comprehensive end-to-end test matrix, expands credential lifecycle unit coverage, and isolates Playwright runtime data so tests cannot read, modify, or delete existing development data.

E2E Coverage

Pages and user flows

• Covers the root redirect plus Dashboard, Usage, Credentials, Account Status, API Test, Debug, Settings, and Login (8 pages).
• Verifies initial rendering, deep links, browser back/forward navigation, responsive viewports, active navigation state, reload stability, and persisted localization preferences.
• Exercises key empty states and interactions for credentials, usage, debug, settings, account status, and API Test.

Server routes and error contracts

• Covers all 35 application routes under app/: health, admin APIs, public OpenAI/Anthropic-compatible APIs, and CodeBuddy auth start/poll/callback routes.
• Covers empty states, parameter validation, malformed JSON, unknown resources, unauthenticated access, missing credentials, controlled upstream failures, idempotent repeated operations, and JSON response shapes.
• Exercises read/write and failure paths for credentials, access keys, passkeys, settings, preferences, usage, debug, stats, and account status APIs.

Isolation and safety

• Playwright always starts its own server with reuseExistingServer: false.
• E2E runs use process-specific CODEBUDDY_STORAGE_FILE_DIR and CODEBUDDY_CREDENTIALS_DIR directories, never the developer's existing credentials or storage.
• Tests run with one worker to prevent file-backed state pollution between cases.

Test Size and Coverage

• E2E: 5 spec files, 104 tests, 2,227 lines; all passed.
• Unit tests: 242 passed.
• Unit coverage: Statements 93.80%, Branches 87.03%, Functions 95.55%, Lines 94.38%.
• Changed-branch coverage: 100.00% (2/2), above the 90% requirement.

Verification

• bun run lint
• bun run format:check
• bun run typecheck
• bun run test:coverage
• bun run test:ci
• bun run test:patch-branches --base "$(git merge-base HEAD origin/main)"
• bun run test:e2e (104 passed)
• bun run build

The production build passes; Turbopack reports only the existing dynamic filesystem access warnings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0c31531e83

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.74%. Comparing base (8d594f2) to head (cdc03f3).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #95      +/-   ##
==========================================
+ Coverage   94.46%   94.74%   +0.28%     
==========================================
  Files          21       21              
  Lines        4242     4246       +4     
  Branches     1232     1233       +1     
==========================================
+ Hits         4007     4023      +16     
+ Misses        235      223      -12     

Flag	Coverage Δ
unittests	94.74% <100.00%> (+0.28%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.