[Deemexlyon]

What this PR does

Closes the four open issues in one pass. PRD §4 flows touched: sign-in / session lifecycle (auth guard used by every role dashboard) and the admin payments console (escrow verification, §7 fulfilment payout trail).

#9 — Restore the session on reload

• src/services/session.ts kicks off POST /auth/refresh on boot without blocking first render; main.tsx fires it once (skipped when a mock/preview session already exists).
• RequireAuth waits in a Restoring your session… state (with useSlowRequestHint) instead of redirecting a signed-in user to /login.
• api-client.ts retries an authenticated request once after a 401. Concurrent 401s share a single in-flight refresh (refreshSession) because core rotates the cookie on every refresh. A failed refresh (401/403) clears the session; a network failure is treated as transient.
• Logout clears local state and the stored CSRF token, so a reload stays signed out.
• Important contract update: docforum-core's Phase 8 CSRF work now requires X-CSRF-Token on /auth/refresh and /auth/logout. The issue text said “cookie-only, no body”, but the live contract needs the header. The per-session csrfToken is now the only value that survives reload, in a first-party docforum_csrf cookie (src/services/csrf-storage.ts) — not localStorage/sessionStorage, and never the access/refresh token. Rationale is documented in ARCHITECTURE_ESSENTIALS.md “CSRF token storage”.
• New tests: boot refresh success/failure/network-down, RequireAuth restoring state, one-refresh-for-concurrent-401s, no refresh recursion, and retry clearing the session.

#10 — Explorer links

• PaymentIntentPanel links stellarTxHash → transaction page and sorobanContractId → contract page via src/features/payments/explorer.ts.
• Links open in a new tab with rel="noopener noreferrer"; null hash/contract renders no link.
• Base URL has one home (VITE_STELLAR_EXPLORER_BASE_URL, documented in .env.example) so mainnet is a config change.
• Component tests assert href/target/rel and the no-link case.

#11 — ESLint in CI

• Flat config (eslint.config.js) with typescript-eslint, eslint-plugin-react-hooks, eslint-plugin-react-refresh, npm run lint, and a lint step in the frontend CI job.
• 0 errors, 13 warnings (pre-existing hook-dependency / fast-refresh export warnings, intentionally left as warnings rather than a mass refactor).
• Existing errors fixed (unused vars, redundant boolean/casts, useless escape/assignment, irregular whitespace). any is allowed only in test files, plus one commented escape hatch in the MSW helper where HttpResponse<unknown> breaks the handlers' generic constraint.
• TypeScript remains 7.0.2 for tsc; the TypeScript 6 API is installed under the typescript alias for typescript-eslint (its peer range excludes 7), as Microsoft's TS 7 side-by-side guidance recommends. @typescript/native provides the TS 7 tsc. .npmrc documents the peer-range workaround.
• Also added the missing @sentry/react dependency — main.tsx already imported it, so npm run typecheck was failing on main before this PR.

#12 — E2E smoke test against real docforum-core

• Playwright (e2e/), one journey: sign up → protected page → reload stays signed in → log out → reload stays logged out → log back in.
• Starts the real backend (core's createApp, no payments startup probes) against a throwaway Postgres, plus Vite. No MSW / no network mocks.
• Separate CI job with a postgres:16 service, pinned core SHA in E2E_CORE_REF, Playwright browser install, and migration step.
• How to run locally and how to bump the core pin: e2e/README.md.

Verification

• npm run typecheck ✅
• npm run lint ✅ (0 errors; 13 pre-existing warnings)
• npm test ✅ 605/605
• npm run build, npm run check:dist, npm run check:stellar-boundary ✅
• npm run test:e2e ✅ locally against a real docforum-core checkout at c65217bc + throwaway Postgres (signup → reload → logout → reload → login).
• Not re-verified against the live GitHub Pages + Render preview this session (the local cookie is SameSite=Lax; production is SameSite=None; Secure). The e2e job exercises the real contract and the production cookie path is unchanged from the previously verified connection.

Docs

• ARCHITECTURE_ESSENTIALS.md: W1 gap removed; CSRF-token storage and session-restore design documented.
• ROADMAP.md: W1 items [Phase W1] Restore session on reload via POST /auth/refresh #9/Add ESLint and run it in CI #11/End-to-end smoke test against a real docforum-core backend #12 and W5 Link transaction hashes and escrows to the Stellar testnet explorer #10 marked done, top status updated, changelog entry.
• README.md / e2e/README.md: lint + e2e commands and back-end setup.

Closes #9
Closes #10
Closes #11
Closes #12

[github-actions]

Malware scan: passed, with notes for the reviewer

Nothing malicious was detected in 27c9ae1. These changes touch sensitive areas and should get a careful look before CI is approved:

Where	Rule	Why
.github/workflows/ci.yml:8	workflow-change	Changes a CI workflow; a maintainer must review before approving runs.

[github-actions]

@Deemexlyon This PR now has merge conflicts with main, most likely because #193 (fix(ci): retry transient GitHub API errors in PR automation) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-web.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared files like ROADMAP.md and ARCHITECTURE*.md. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[drips-wave]

@Deemexlyon Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[github-actions]

@Deemexlyon This PR now has merge conflicts with main, most likely because #135 (feat(messaging): message attachments — upload with progress, preview and secure download (#23)) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-web.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared files like ROADMAP.md and ARCHITECTURE*.md. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[github-actions]

@Deemexlyon This PR now has merge conflicts with main, most likely because #156 (feat(testing): add accessibility and visual CI suites) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-web.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[afeezorobsco-cyber]

@Deemexlyon CI is failing on this branch against the latest main, so it can't be merged yet. The errors from the latest run:

E2E smoke (real docforum-core), Frontend (typecheck + lint + test + build)

npm error Missing: levn@0.4.1 from lock file
npm error Missing: playwright@1.64.1 from lock file
npm error Missing: uri-js@4.4.1 from lock file
npm error Missing: balanced-match@4.0.4 from lock file
npm error Missing: cross-spawn@7.0.6 from lock file
npm error Missing: file-entry-cache@11.1.5 from lock file
npm error Missing: find-up@5.0.0 from lock file
npm error Missing: ignore@5.3.2 from lock file

package-lock.json is out of sync with package.json. Run npm install and commit the updated lockfile.

package-lock.json is out of sync with package.json. Run npm install and commit the updated lockfile.

This PR also conflicts with main again, so please rebase first, then fix the above.

[github-actions]

@Deemexlyon This PR now has merge conflicts with main, most likely because #157 (feat(platform): complete W7 API client, errors, PWA, and i18n) was just merged, so it can't be merged until it's rebased:

git fetch upstream            # upstream = https://github.com/DocForum/docforum-web.git
git rebase upstream/main
# resolve the conflicts, re-run the tests, then:
git push --force-with-lease

The usual culprits are shared docs like ROADMAP.md and ARCHITECTURE*.md. If the conflict is in the ROADMAP.md changelog, move your entry into a new file under changelog.d/ (see changelog.d/README.md) rather than resolving it in place, so it can't conflict again. CI re-runs when you push, and the needs-rebase label is removed automatically once the conflicts are resolved.

_{Automated message. It won't repeat unless the PR conflicts again after your next push.}

[afeezorobsco-cyber]

@Deemexlyon All three jobs fail at npm ci because package-lock.json no longer matches package.json after the latest merge from main:

npm error `npm ci` can only install packages when your package.json and package-lock.json are in sync.
npm error Missing: @eslint/js@10.0.1 from lock file
npm error Missing: @typescript/native@7.0.2 from lock file
npm error Missing: @typescript/old@6.0.3 from lock file
npm error Missing: @typescript-eslint/eslint-plugin@8.72.0 from lock file

Note that this push also dropped the .npmrc (legacy-peer-deps=true) that your earlier version needed for typescript-eslint's TypeScript peer range. Please restore it if the install needs it, run npm install with npm 10, commit the updated lockfile, check npm ci && npm run lint && npm run typecheck && npm test, and push.

[github-actions]

🔎 Preview build (downloadable artifact)

Download the preview artifact · build log

• Built from 27c9ae1; GitHub sign-in is required to download.
• This build is not published to GitHub Pages or any other shared origin.
• Runs against the mock API only — fake seed data, no real backend, no real credentials.
• To view it locally: unzip the artifact, then serve the folder (for example
  npx serve <folder>) and open the URL it prints.
• The artifact expires after 14 days and is replaced on every push to this PR.

[afeezorobsco-cyber]

@Deemexlyon (and thanks @Kaybee973 for the lockfile fix) Every check is green now, but this PR can't merge: it renames the CI job to Frontend (typecheck + lint + test + build), and branch protection requires a check named exactly Frontend (typecheck + test + build). With the new name that required check never reports, so the PR stays blocked.

Please keep the job's name: as Frontend (typecheck + test + build) (the lint step can stay inside it) and push. Then it can merge.