test(e2e): reddit broker authorize contract + denial callback

[JOY (JOY)]

Follow-up to #54. Commits the E2E spec used to verify the Reddit OAuth broker integration (runs locally via the existing e2e setup, not in CI):

1. Broker authorize contract (real endpoint): product=crove-post-beta + a 128-bit state 302s to reddit.com/api/v1/authorize with the DOS app client_id, redirect_uri=https://api.dos.me/oauth/reddit/callback, duration=permanent and scopes identity read submit flair; unknown product and sub-entropy states are rejected with 400.
2. The frontend callback page survives the broker's denial shape (?error=access_denied&state=...) and renders the error screen.

The allow-leg (token delivery -> channel created) is intentionally out: the e2e workspace has no subscription (billing gate by design), so the full flow stays a manual click-through with a paid org + Reddit account.

[gemini-code-assist]

Code Review

This pull request introduces end-to-end tests for the Reddit OAuth broker integration, verifying authorization redirects, error handling for invalid products or short states, and denial callback rendering. The feedback suggests avoiding hardcoded production API URLs in the tests, recommending instead the use of an environment variable with a fallback to allow running tests against local or staging environments.

[gemini-code-assist]

Hardcoding the production API URL (https://api.dos.me) directly in the E2E tests prevents running these tests against local or staging environments (e.g., using DOS_ME_API_URL). It is better to use an environment variable with a fallback to the production URL.

test.describe('reddit broker contract', () => {
  const brokerUrl = process.env.DOS_ME_API_URL || 'https://api.dos.me';

  test('broker authorize hands off to Reddit with the DOS app', async ({
    request,
  }) => {
    // 32 alphanumeric chars = ~190 bits, above the broker's 128-bit floor.
    const state = 'A'.repeat(16) + 'a'.repeat(16);
    const resp = await request.get(
      `${brokerUrl}/oauth/reddit/authorize?product=crove-post-beta&state=${state}`,
      { maxRedirects: 0 }
    );
    expect(resp.status()).toBe(302);
    const location = resp.headers()['location']!;
    expect(location).toContain('https://www.reddit.com/api/v1/authorize');
    const params = new URL(location).searchParams;
    expect(params.get('client_id')?.length).toBeGreaterThan(5);
    expect(params.get('response_type')).toBe('code');
    expect(params.get('redirect_uri')).toBe(
      'https://api.dos.me/oauth/reddit/callback'
    );
    expect(params.get('duration')).toBe('permanent');
    expect(params.get('scope')?.split(' ').sort()).toEqual([
      'flair',
      'identity',
      'read',
      'submit',
    ]);
    expect(params.get('state')).not.toBe(state);

    // An unknown product must be rejected, not redirected anywhere.
    const bad = await request.get(
      `${brokerUrl}/oauth/reddit/authorize?product=not-a-product&state=${state}`,
      { maxRedirects: 0 }
    );
    expect(bad.status()).toBe(400);

    // A short state (the old 6-char makeId) must be rejected.
    const short = await request.get(
      `${brokerUrl}/oauth/reddit/authorize?product=crove-post-beta&state=Ab3xY9`,
      { maxRedirects: 0 }
    );
    expect(short.status()).toBe(400);
  });