feat: Add integration tests - #195

• pnpm-lock.yaml: Language not supported

.github/workflows/ci-integration.yml:33

• Other workflows pin GitHub Actions to commit SHAs (e.g. .github/workflows/ci-build.yml:37). Pin pnpm/action-setup here as well to avoid depending on a mutable @v6 tag.

      - uses: pnpm/action-setup@v6

.github/workflows/ci-integration.yml:42

• Other workflows pin GitHub Actions to commit SHAs (e.g. .github/workflows/ci-build.yml:32). Pin actions/setup-node here as well to keep supply-chain protections consistent.

      - name: Install Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: .nvmrc
          cache: 'pnpm'

scripts/dev-integration.mjs:81

• shutdown() re-sends SIGINT/SIGTERM to the current process while those signals still have handlers installed (the loop below). That prevents the default termination behaviour and can leave dev:integration hanging after Ctrl+C / SIGTERM (stack stops, but process never exits). Remove the signal handlers before re-killing, or just process.exit() after cleanup.
  e2e/integration/signalr.spec.ts:23
• Typo in variable name: signarErrors looks like it should be signalrErrors (matches the test intent and regex).

    // Filter out noise unrelated to SignalR
    const signarErrors = errors.filter((e) => /signalr|websocket|hub|negotiate/i.test(e));
    expect(signarErrors).toHaveLength(0);

.github/workflows/ci-integration.yml:32

• Other workflows pin GitHub Actions to full commit SHAs (e.g. .github/workflows/ci-build.yml:27), but this workflow uses floating version tags. Pinning here too improves supply-chain safety and keeps conventions consistent.

This issue also appears in the following locations of the same file:

• line 33
• line 38

      - name: Checkout
        uses: actions/checkout@v6

e2e/integration/lib/test-fixtures.ts:47

• Defaulting cookie domain to the backend host (apiHost) means auth cookies won’t be sent when TEST_FRONTEND_URL and TEST_BACKEND_URL have different hostnames (e.g. 127.0.0.1 vs localhost). Default to the frontend hostname for Playwright context cookies in this harness (and keep apiHost only as a fallback/consistency check).

        domain: attrMap['domain'] ?? apiHost,

vite.config.ts:273

• Integration mode relies on a fixed baseURL (default http://localhost:5173) in Playwright. Consider enabling strictPort: true so Vite fails fast instead of silently switching to another port when 5173 is already in use (which would make the integration runner probe the wrong origin).
  vite.config.ts:202
• LocalServer.config is used as the Vite server config shape, but it currently omits strictPort. In integration mode the Playwright baseURL is fixed to http://localhost:5173; without strictPort, Vite will auto-increment the port if 5173 is taken, causing the integration runner to probe the wrong URL.

This issue also appears on line 269 of the same file.
vite.config.ts:261

• proxyRes.headers['set-cookie'] can be either a string or an array of strings. Calling .map unconditionally will throw when only a single cookie is set (string case). Normalize to an array before mapping.
  e2e/integration/signalr.spec.ts:23
• Typo in variable name: signarErrors → signalErrors. Keeping the correct spelling makes the intent clearer and avoids copy/paste typos elsewhere.

    const signarErrors = errors.filter((e) => /signalr|websocket|hub|negotiate/i.test(e));
    expect(signarErrors).toHaveLength(0);