fix(user): address Copilot review comments on PR #168

- Separate loadMoreError from initial error state to preserve existing items on pagination failure
- Add migration for itineraries(created_at) index to optimize public feed ORDER BY performance
- Add test case: password-protected itineraries excluded from public feed
- Fix a11y label/id associations in login/register form inputs

Author: Sora4431

apps/api/migrations/0013_add_itineraries_created_at_index.sql

@@ -0,0 +1,2 @@
+-- Add index on itineraries.created_at for public feed pagination performance
+CREATE INDEX IF NOT EXISTS idx_itineraries_created_at ON itineraries(created_at DESC);

apps/api/test/users-profile.test.ts

@@ -385,4 +385,19 @@ describe('GET /api/v1/users (public feed)', () => {
     expect(json2.data.items).toHaveLength(1);
     expect(json2.data.hasMore).toBe(false);
   });
+
+  it('excludes password-protected itineraries from public feed', async () => {
+    const token = await registerAndGetToken('feeduser5', 'feed5@example.com');
+
+    // Create a password-protected itinerary
+    await app.request('/api/v1/itineraries', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+      body: JSON.stringify({ title: 'パスワード付きしおり', password: 'secret123' }),
+    }, env);
+
+    const res = await app.request('/api/v1/users', {}, env);
+    const json = await res.json() as { data: { items: unknown[] } };
+    expect(json.data.items).toHaveLength(0);
+  });
 });

apps/web/src/routes/profile/+page.svelte

@@ -234,8 +234,9 @@
         <form onsubmit={(e) => { e.preventDefault(); handleSubmit(); }} class="space-y-4">
           {#if mode === "register"}
             <div>
-              <label class="block text-sm font-medium text-gray-700 mb-1">ユーザー名</label>
+              <label for="auth-username" class="block text-sm font-medium text-gray-700 mb-1">ユーザー名</label>
               <input
+                id="auth-username"
                 type="text"
                 bind:value={usernameInput}
                 required
@@ -244,17 +245,19 @@
             </div>
           {/if}
           <div>
-            <label class="block text-sm font-medium text-gray-700 mb-1">メールアドレス</label>
+            <label for="auth-email" class="block text-sm font-medium text-gray-700 mb-1">メールアドレス</label>
             <input
+              id="auth-email"
               type="email"
               bind:value={email}
               required
               class="w-full border border-gray-300 rounded-md px-3 py-2 text-sm focus:outline-none focus:ring-2 focus:ring-indigo-500"
             />
           </div>
           <div>
-            <label class="block text-sm font-medium text-gray-700 mb-1">パスワード</label>
+            <label for="auth-password" class="block text-sm font-medium text-gray-700 mb-1">パスワード</label>
             <input
+              id="auth-password"
               type="password"
               bind:value={password}
               required

apps/web/src/routes/users/+page.svelte

@@ -8,6 +8,7 @@
   let loadingMore = $state(false);
   let hasMore = $state(false);
   let error = $state<string | null>(null);
+  let loadMoreError = $state<string | null>(null);
 
   onMount(async () => {
     try {
@@ -23,12 +24,13 @@
 
   async function loadMore() {
     loadingMore = true;
+    loadMoreError = null;
     try {
       const result = await userApi.getPublicFeed(items.length);
       items = [...items, ...result.items];
       hasMore = result.hasMore;
     } catch {
-      error = "読み込みに失敗しました";
+      loadMoreError = "追加の読み込みに失敗しました";
     } finally {
       loadingMore = false;
     }
@@ -74,6 +76,10 @@
         {/each}
       </div>
 
+      {#if loadMoreError}
+        <p class="text-red-500 text-center mt-4 text-sm">{loadMoreError}</p>
+      {/if}
+
       {#if hasMore}
         <div class="mt-8 text-center">
           <button