Stabilize CI runtime for updated deps and unblock Dependabot auto-format flow (#185)

* chore: apply ci and dependabot remediation changes

* chore: auto-fix linting and formatting issues

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

tests/e2e/api-tokens.spec.ts

@@ -85,7 +85,10 @@ test("an API token can authenticate /mcp", async ({ page }) => {
         headers: await csrfHeaders(page),
         data: { ...baseSettings, enable_mcp: true },
     })
-    expect(enableResp.ok(), "PATCH /api/v1/setting must succeed to enable MCP for the test").toBeTruthy()
+    expect(
+        enableResp.ok(),
+        "PATCH /api/v1/setting must succeed to enable MCP for the test",
+    ).toBeTruthy()
 
     try {
         const apiResp = await page.request.post("/api/v1/api-tokens", {

tests/e2e/auth.spec.ts

@@ -1,6 +1,13 @@
 import { expect } from "@playwright/test"
 
-import { csrfRequest, defaultAdmin, expectAuthenticated, expectUnauthenticated, loginAs, test } from "./fixtures"
+import {
+    csrfRequest,
+    defaultAdmin,
+    expectAuthenticated,
+    expectUnauthenticated,
+    loginAs,
+    test,
+} from "./fixtures"
 
 test("login persists session via cookie and getProfile succeeds", async ({ page }) => {
     await loginAs(page, defaultAdmin)
@@ -51,7 +58,10 @@ test("password change rotates TokenVersion and revokes existing session", async
                     reject_password: false,
                 },
             })
-            expect(restoreResp.ok(), "password restore must succeed so other suites can still log in").toBeTruthy()
+            expect(
+                restoreResp.ok(),
+                "password restore must succeed so other suites can still log in",
+            ).toBeTruthy()
         }
     }
 })

tests/e2e/fixtures.ts

@@ -1,4 +1,4 @@
-import { Page, Request, expect, test as base } from "@playwright/test"
+import { Page, Request, test as base, expect } from "@playwright/test"
 
 export type LoginContext = {
     username: string
@@ -39,7 +39,8 @@ export async function csrfHeaders(page: Page): Promise<Record<string, string>> {
     await expect
         .poll(
             async () => {
-                value = (await page.context().cookies()).find((c) => c.name === "nz-csrf")?.value ?? ""
+                value =
+                    (await page.context().cookies()).find((c) => c.name === "nz-csrf")?.value ?? ""
                 return value
             },
             { timeout: 10_000 },

tests/e2e/fm-csrf.spec.ts

@@ -17,6 +17,9 @@ test("file manager creation only accepts POST", async ({ adminPage: page }) => {
     })
     expect(postResp.status()).toBe(200)
     const body = await postResp.json()
-    expect(body.success, "without a connected agent server the POST surfaces a Service error, but the route is reachable").not.toBe(true)
+    expect(
+        body.success,
+        "without a connected agent server the POST surfaces a Service error, but the route is reachable",
+    ).not.toBe(true)
     expect(body.error).toBeTruthy()
 })

tests/e2e/visibility.spec.ts

@@ -2,7 +2,10 @@ import { expect } from "@playwright/test"
 
 import { csrfHeaders, test } from "./fixtures"
 
-test("server-group hides guest-empty groups from anonymous callers", async ({ adminPage: page, browser }) => {
+test("server-group hides guest-empty groups from anonymous callers", async ({
+    adminPage: page,
+    browser,
+}) => {
     const tag = Date.now().toString(36)
     const visibleName = `e2e-visible-${tag}`
     const hiddenName = `e2e-hidden-${tag}`
@@ -12,7 +15,9 @@ test("server-group hides guest-empty groups from anonymous callers", async ({ ad
     // scenario boils down to "no group is guest-visible", which the assertion below still covers.
     const serversResp = await page.request.get("/api/v1/server")
     expect(serversResp.ok()).toBeTruthy()
-    const serversBody = (await serversResp.json()) as { data: Array<{ id: number; hide_for_guest?: boolean }> }
+    const serversBody = (await serversResp.json()) as {
+        data: Array<{ id: number; hide_for_guest?: boolean }>
+    }
     const publicServer = serversBody.data?.find((s) => !s.hide_for_guest)
 
     const createdGroupIDs: number[] = []
@@ -40,9 +45,14 @@ test("server-group hides guest-empty groups from anonymous callers", async ({ ad
                 data: Array<{ group: { name: string }; servers: number[] }>
             }
             const names = (guestBody.data || []).map((it) => it.group.name)
-            expect(names, "guest must NOT see groups with zero visible servers").not.toContain(hiddenName)
+            expect(names, "guest must NOT see groups with zero visible servers").not.toContain(
+                hiddenName,
+            )
             if (publicServer) {
-                expect(names, "guest still sees groups that contain a guest-visible server").toContain(visibleName)
+                expect(
+                    names,
+                    "guest still sees groups that contain a guest-visible server",
+                ).toContain(visibleName)
             }
         } finally {
             await guestCtx.close()