Raise app quality to A+: coverage, a11y, refactors, release security

[domsteil]

Summary

Closes the gaps from the codebase review to take the app from B+ to A+. Suite is fully green: 1,852 tests across 166 files pass, with tsc, electron tsc, and ESLint (--max-warnings 0) all clean, and a production vite build succeeds.

Testing

• Added ~980 tests. Line coverage 42.6% → 77%, functions → 79%, branches → 69%.
• New coverage for all shared components, every feature module (settings/templates/webhooks/chat-playground/connections/agent-console), 9 hooks, the OAuth main-process modules (were 0%), and lib internals (telemetry, cache, api error paths, stream hook).
• Coverage thresholds in vite.config.mts raised from 60/50 to a 75/76/66/75 regression floor.
• New docs/TESTING.md (strategy + conventions) linked from CONTRIBUTING.

Bugs surfaced and fixed by the new tests

• Telemetry leaked API keys. sanitizeProperties matched its sensitive-key list against a lowercased key, but the list contained 'apiKey' (capital K), so it never matched and API keys shipped to the telemetry endpoint unredacted. Now lowercase.
• Agent-console log cache wiped itself on mount, breaking "Restore cached logs". Guarded so only explicit clears wipe it.
• AccountSettings rendered the literal string "undefined" for a null tenant tier.

Architecture

• Decomposed Dashboard.tsx (1,220 → 354 lines) and Voice.tsx (1,110 → ~400) into src/features/ modules, matching the agent-console pattern. Behavior preserved (verified by existing tests + production build).

Accessibility

• Roles/aria-live for status indicators and toasts (now polite with role="alert"/status), aria-labels on icon-only buttons, menu/dialog keyboard support (Escape/arrows), role="switch" toggles, form label associations, keyboard hold-to-talk on the voice mic.

Security / release

• Enabled macOS notarization (removed notarize: false), set asar: true, and release CI now fails v* tag builds without signing certs rather than shipping unsigned.
• Dev store no longer falls back to plaintext — auto-generates a per-install key at userData/.store-key (owner-only) when STORE_ENCRYPTION_KEY is unset.
• Routed all raw console.* in src/lib and src/stores through the structured logger (redacts sensitive fields, silent in tests).
• Documented all of the above in SECURITY.md.

Note

One test failed once under --coverage during the heavy parallel authoring phase and then passed on 6 consecutive runs (including 5 stress-runs of the most race-prone file). The failure correlated with peak machine load — likely a waitFor deadline exceeded under contention rather than a logic defect — but it could not be reproduced to root-cause definitively. Flagging it: if it recurs in CI, the stream-hook reconnection tests are the place to look.

🤖 Generated with Claude Code