Release 0.2.0-next.5: auth fail-safe + regression test

[max-bader]

What

Cuts the next (canary) release that ships the onAuthStateChange fail-safe fix, and adds a regression test for it.

• Bump 0.1.1 → 0.2.0-next.5 (publishes to the next dist-tag on release).
• Regression test: a rejecting /users/me session check must still fire SIGNED_OUT.
• Changelog entry.

Why

The code fix (add .catch(() => callback("SIGNED_OUT", null)) in onAuthStateChange) already landed on main in #2 — but main is still at 0.1.1, so it hasn't been published to the next channel that sdk-canary apps actually pull. Until a next release is cut, the fix reaches no app.

Background: without the .catch, when the initial /users/me fetch rejects (cross-origin/network failure — e.g. the sandbox-preview context Cloudflare screenshots run in), the state callback never fired, BoolAuthProvider.loading never cleared, and <AuthGate> rendered null forever. The app hung on a blank page — which is what made project-card thumbnails capture an empty background regardless of screenshot delay.

After merge

Cut the release to publish to next:

gh release create v0.2.0-next.5 --prerelease --title v0.2.0-next.5

The publish workflow derives the dist-tag from the prerelease version (0.2.0-next.5 → next). Then sdk-canary apps pick it up on their next sandbox boot, and re-capturing a project (screenshot lab) should show the sign-in screen instead of a blank card.

Test plan

• bun run typecheck — clean
• bun test — 19 pass (new reject-path test included; fails against the pre-Handle getUser rejection in onAuthStateChange #2 code)
• bun run build — clean

🤖 Generated with Claude Code