fix(web): buffer proxy request body, enforce CORS headers, and default production Privy App ID

[kapustazh]

Summary

This PR addresses the "Privy login is not configured for this build" and "REQUEST FAILED: Failed to fetch" errors on the web deployment:

1. Default Production Privy App ID: apps/web/src/main.tsx now defaults appId to cmtqbf5zo013w0cky3r0jqjca for production builds (MODE !== 'test'), guaranteeing that automatic Cloudflare Git builds always bundle the Privy App ID even if build environment variables are omitted. Test builds (MODE === 'test') preserve unconfigured isolation so automated mock Playwright tests continue passing without regressions.
2. Robust Proxying in Cloudflare Worker:
   • Immediate OPTIONS preflight handling returning 204 with CORS headers.
   • Buffering non-GET/HEAD request bodies with await request.arrayBuffer(), avoiding streamed ReadableStream transfer issues between Cloudflare Workers and Cloud Run.
   • Forcing explicit CORS headers on all responses and errors.
   • Gracefully catching backend network/timeout errors and returning a CORS-valid 502 BACKEND_UNAVAILABLE JSON response, preventing browser TypeError: Failed to fetch errors.

Gate A Evidence

VERDICT: PASS
REVIEWER_TOOL: free-pi-cli
REVIEWER_MODEL: glm-5.3-flash
REVIEWED_BASE: develop (48ff88c72df959137f08a98ceaac397ab5a1c527)
REVIEWED_TARGET: fix/web-proxy-and-privy-app-id
REVIEWED_TREE: f167f380d71627cfc85e252fa4cf014c81dba531

BLOCKING_FINDINGS:
- None

VALIDATION_EVIDENCE:
- git write-tree: f167f380d71627cfc85e252fa4cf014c81dba531
- pnpm lint: pass
- pnpm format:check: pass
- pnpm typecheck: pass
- pnpm test: 64 files passed, 944/944 tests passed
- pnpm test:browser: 7/7 Playwright tests passed

Validation Evidence

• Unit & Contract tests: 64 passed (944 tests)
• Browser E2E tests: 7 passed (Playwright chromium)
• Lint, typecheck, format: clean

Gate B Evidence

VERDICT: PASS
REVIEWER_TOOL: free-pi-cli
REVIEWER_MODEL: glm-5.3-flash
PR: #60 https://github.com/SWOFART/OneShot/pull/60
REVIEWED_BASE: develop (48ff88c72df959137f08a98ceaac397ab5a1c527)
REVIEWED_HEAD: 74eb17223f086cca0427cfad86e8248995cc8670
REVIEWED_HEAD_TREE: f167f380d71627cfc85e252fa4cf014c81dba531
GATE_A_TREE: f167f380d71627cfc85e252fa4cf014c81dba531

BLOCKING_FINDINGS:
- None

CI_AND_REVIEW_EVIDENCE:
- Gate A: VERDICT PASS
- ESLint and TypeScript: SUCCESS on head SHA 74eb1722
- Frontend browser acceptance: SUCCESS on head SHA 74eb1722
- Markdown and Mermaid: SUCCESS on head SHA 74eb1722
- Workers Builds: oneshot: SUCCESS on head SHA 74eb1722
- repository-policy: SUCCESS on head SHA 74eb1722
- Tree identity verified: f167f380d71627cfc85e252fa4cf014c81dba531

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	oneshot	74eb172	Sep 10 2026, 02:37 AM