fix: repair broken merges, dead SSE reconnect loop, and make suite green

[Syringe7]

Summary

Several previously merged PRs landed with failing CI, leaving spliced or double-escaped code and tests written against an API that never shipped. This PR repairs both production bugs and the test suite. Builds on the partial cleanup already done in #e9ae185 / 6225763 (parallel fixes for the same corruption — thank you!), which this branch is rebased on top of.

Production fixes

• src/lib/session-sse.ts (two real bugs):
  • The SSE parser split on literal "\n" text instead of newlines (double-escaped escapes introduced in 0f251e5), so session_revoked events were never detected — server-initiated forced logouts silently never fired. Fixes replaceAll("\\r\\n","\\n") / split("\\n") / join("\\n") → correct "\r\n" / "\n".
  • Non-200 responses hit an early return, never scheduling the promised reconnect (the code warned retrying then did nothing). Completed the abandoned shouldRetry refactor (from bf2986a) so the backoff block is the single reconnect path: 401/403 stop retrying (after emitting session_revoked), everything else reconnects with backoff, and the null-body path no longer silently drops the stream.
• src/lib/outages.ts: optional axios signal violates exactOptionalPropertyTypes; now uses the repo's existing spread-guard pattern (same as src/services/outages.ts).
• src/components/CommandPalette.tsx: removed duplicated useMemo, useCallback React import (9704b1c).
• package.json: removed accidental "install" and "npm" dependencies (mistaken installs from bd52b7a); lockfile regenerates ~140 packages lighter.

Test repairs (stale tests updated to current contracts)

• tests/session-sse.test.ts: rewritten against the committed parseSessionSseFrame API — the committed file imported a processFrame(frame, onEvent) refactor that never landed (verified via the stale vitest-session-sse.json CI artifact, where those tests only passed on the author's machine).
• tests/redirect.test.ts, tests/export-filename.test.ts: broken string literals / truncated suite from spliced merges (aligns with the same fix done upstream in e9ae185 — conflict resolution takes upstream's equivalent version to minimize diff).
• tests/auth-flow.test.tsx: the provider now always probes the cookie-only /auth/session endpoint (a missing local flag doesn't rule out valid httpOnly cookies); tests updated to mock that probe.
• tests/settings-wallet.test.tsx / tests/settings-theme.test.tsx: added missing useRouter mock + I18nProvider wrapper; added a default jsdom matchMedia stub in vitest.setup.ts (per-test stubs still override it).
• tests/payments-view.test.tsx: RouteEmptyState's live-region announcer repeats the title, so text queries matched twice — query the heading role instead.
• tests/useOutagesTableState.test.ts: filter presets live under the synced apexchain_user_preferences object now; also reset the preferences module's module-level state between tests.
• tests/contract.test.ts: gates on a 1.5s /health reachability probe and skipIf unavailable, so the default unit suite doesn't fail without the Prism mock backend (:4010).

Tooling

• eslint.config.mjs: typed-linting rules crashed ESLint because they applied to files with no tsconfig type info (including the config itself). Scoped no-explicit-any / no-unsafe-* to src/** and tests/** with projectService: true. Lint now runs end-to-end.

Verification

• npm run typecheck — clean
• npm test — 287 passed, 3 skipped (contract tests without a live backend), 0 failures
• npm run lint — runs cleanly; remaining errors/warnings are pre-existing code-quality debt (setState-in-effect patterns, any in a tour test) deliberately left out of this repair commit
• package-lock.json diff vs HEAD: only the install/npm subtrees removed — no version changes

🤖 Generated with Codebuff
Co-Authored-By: Codebuff noreply@codebuff.com

Linked issues

Fixes #300