fix(10-04): prettier format + remove unnecessary type assertions

- Run prettier on all new/modified PWA files (CredentialSheet, SetupBanner, AdminPage, admin.spec.ts)
- Remove unnecessary 'as React.RefObject<HTMLElement | null>' casts flagged by @typescript-eslint/no-unnecessary-type-assertion
- Format pre-existing API files from Plans 02/03 (me.ts, user.test.ts, requireAdmin.test.ts, me.test.ts)
- All 270 API tests + 191 PWA vitest tests pass; lint/typecheck/build clean

apps/api/src/routes/me.ts

@@ -167,35 +167,36 @@ const meNoEchoHook = (result: { success: boolean }, c: Context) => {
   }
 };
 
-meRouter.post(
-  '/credential',
-  zValidator('json', meCredentialSchema, meNoEchoHook),
-  async (c) => {
-    // Pitfall 6: ALWAYS resolve currentUserId from the session — never from the body.
-    const currentUserId = await resolveUserId(c);
-    if (!currentUserId) {
-      return c.json({ error: 'Unauthorized' }, 401);
+meRouter.post('/credential', zValidator('json', meCredentialSchema, meNoEchoHook), async (c) => {
+  // Pitfall 6: ALWAYS resolve currentUserId from the session — never from the body.
+  const currentUserId = await resolveUserId(c);
+  if (!currentUserId) {
+    return c.json({ error: 'Unauthorized' }, 401);
+  }
+
+  const { fastmailEmail, appPassword, providerType } = c.req.valid('json');
+  // T-10-10: NEVER log appPassword or c.req.valid('json') here
+
+  try {
+    // D-07: identical validate→encrypt→store→sync path as admin, but always with
+    // currentUserId (not a body userId). Admin passes the target member's userId;
+    // self-service passes the authenticated session userId. Same helper, same argument order.
+    await validateEncryptAndStoreCredential(
+      currentUserId,
+      fastmailEmail,
+      appPassword,
+      providerType,
+    );
+  } catch (err) {
+    if (err instanceof CredentialValidationError) {
+      return c.json({ error: 'Invalid request' }, 400);
     }
+    console.error(
+      '[me/POST /credential] Unexpected error:',
+      err instanceof Error ? err.message : String(err),
+    );
+    return c.json({ error: 'Service unavailable' }, 503);
+  }
 
-    const { fastmailEmail, appPassword, providerType } = c.req.valid('json');
-    // T-10-10: NEVER log appPassword or c.req.valid('json') here
-
-    try {
-      // D-07: identical validate→encrypt→store→sync path as admin, but always with
-      // currentUserId (not a body userId). Admin passes the target member's userId;
-      // self-service passes the authenticated session userId. Same helper, same argument order.
-      await validateEncryptAndStoreCredential(currentUserId, fastmailEmail, appPassword, providerType);
-    } catch (err) {
-      if (err instanceof CredentialValidationError) {
-        return c.json({ error: 'Invalid request' }, 400);
-      }
-      console.error(
-        '[me/POST /credential] Unexpected error:',
-        err instanceof Error ? err.message : String(err),
-      );
-      return c.json({ error: 'Service unavailable' }, 503);
-    }
-
-    return c.json({ ok: true }, 200);
-  },
-);
+  return c.json({ ok: true }, 200);
+});

apps/api/tests/auth/user.test.ts

@@ -314,7 +314,15 @@ describe('upsertUser', () => {
       }
       // Re-fetch after insert
       return makeSelectChain([
-        { id: 10, oidcIss: iss, oidcSub: sub, displayName: null, color: COLOR_PALETTE[0], isAdmin: true, createdAt: new Date() },
+        {
+          id: 10,
+          oidcIss: iss,
+          oidcSub: sub,
+          displayName: null,
+          color: COLOR_PALETTE[0],
+          isAdmin: true,
+          createdAt: new Date(),
+        },
       ]);
     });
     mockDb.insert.mockReturnValue(makeInsertChain([{ id: 10 }]));
@@ -344,7 +352,15 @@ describe('upsertUser', () => {
         return makeSelectChain([{ count: 1 }]);
       }
       return makeSelectChain([
-        { id: 11, oidcIss: iss, oidcSub: sub, displayName: null, color: COLOR_PALETTE[1], isAdmin: false, createdAt: new Date() },
+        {
+          id: 11,
+          oidcIss: iss,
+          oidcSub: sub,
+          displayName: null,
+          color: COLOR_PALETTE[1],
+          isAdmin: false,
+          createdAt: new Date(),
+        },
       ]);
     });
     mockDb.insert.mockReturnValue(makeInsertChain([{ id: 11 }]));

apps/api/tests/lib/requireAdmin.test.ts

@@ -24,7 +24,13 @@ vi.mock('../../src/db/client.js', () => ({
 
 // Bring in the ContextVariableMap augmentation (sets up c.get('user') typing)
 vi.mock('../../src/auth/devBypass.js', () => ({
-  DEV_USER: { id: 1, oidcIss: 'dev', oidcSub: 'dev-user', displayName: 'Dev User', color: '#4A90D9' },
+  DEV_USER: {
+    id: 1,
+    oidcIss: 'dev',
+    oidcSub: 'dev-user',
+    displayName: 'Dev User',
+    color: '#4A90D9',
+  },
   devAuthBypass: () => async (_c: unknown, next: () => Promise<void>) => next(),
   COLOR_PALETTE: ['#4A90D9'],
 }));

apps/api/tests/routes/me.test.ts

@@ -167,13 +167,16 @@ describe('GET /api/me — isAdmin + needsProviderSetup (Plan 10-02, D-03)', () =
     let callCount = 0;
     vi.mocked(db.select).mockImplementation(() => {
       callCount++;
-      const limitFn = callCount === 1
-        ? vi.fn().mockResolvedValue([{ isAdmin: true }])   // users.isAdmin lookup
-        : vi.fn().mockResolvedValue([]);                    // memberCredentials lookup (none)
+      const limitFn =
+        callCount === 1
+          ? vi.fn().mockResolvedValue([{ isAdmin: true }]) // users.isAdmin lookup
+          : vi.fn().mockResolvedValue([]); // memberCredentials lookup (none)
       return {
         from: vi.fn().mockReturnValue({
           where: vi.fn().mockReturnValue({ limit: limitFn }),
-          innerJoin: vi.fn().mockReturnValue({ innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }) }),
+          innerJoin: vi.fn().mockReturnValue({
+            innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }),
+          }),
         }),
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
       } as any;
@@ -183,7 +186,9 @@ describe('GET /api/me — isAdmin + needsProviderSetup (Plan 10-02, D-03)', () =
     const res = await app.request('/api/me');
     expect(res.status).toBe(200);
 
-    const body = (await res.json()) as { user: { id: number; isAdmin: boolean; needsProviderSetup: boolean } };
+    const body = (await res.json()) as {
+      user: { id: number; isAdmin: boolean; needsProviderSetup: boolean };
+    };
     expect(body.user).toHaveProperty('isAdmin');
     expect(body.user.isAdmin).toBe(true); // DB returns true, not hardcoded
   });
@@ -194,13 +199,16 @@ describe('GET /api/me — isAdmin + needsProviderSetup (Plan 10-02, D-03)', () =
     let callCount = 0;
     vi.mocked(db.select).mockImplementation(() => {
       callCount++;
-      const limitFn = callCount === 1
-        ? vi.fn().mockResolvedValue([{ isAdmin: false }])  // users.isAdmin lookup
-        : vi.fn().mockResolvedValue([]);                   // no member_credentials row
+      const limitFn =
+        callCount === 1
+          ? vi.fn().mockResolvedValue([{ isAdmin: false }]) // users.isAdmin lookup
+          : vi.fn().mockResolvedValue([]); // no member_credentials row
       return {
         from: vi.fn().mockReturnValue({
           where: vi.fn().mockReturnValue({ limit: limitFn }),
-          innerJoin: vi.fn().mockReturnValue({ innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }) }),
+          innerJoin: vi.fn().mockReturnValue({
+            innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }),
+          }),
         }),
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
       } as any;
@@ -221,13 +229,16 @@ describe('GET /api/me — isAdmin + needsProviderSetup (Plan 10-02, D-03)', () =
     let callCount = 0;
     vi.mocked(db.select).mockImplementation(() => {
       callCount++;
-      const limitFn = callCount === 1
-        ? vi.fn().mockResolvedValue([{ isAdmin: false }])        // users.isAdmin lookup
-        : vi.fn().mockResolvedValue([{ id: 7 }]);               // has member_credentials row
+      const limitFn =
+        callCount === 1
+          ? vi.fn().mockResolvedValue([{ isAdmin: false }]) // users.isAdmin lookup
+          : vi.fn().mockResolvedValue([{ id: 7 }]); // has member_credentials row
       return {
         from: vi.fn().mockReturnValue({
           where: vi.fn().mockReturnValue({ limit: limitFn }),
-          innerJoin: vi.fn().mockReturnValue({ innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }) }),
+          innerJoin: vi.fn().mockReturnValue({
+            innerJoin: vi.fn().mockReturnValue({ where: vi.fn().mockResolvedValue([]) }),
+          }),
         }),
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
       } as any;