[pdevito3]

Why

Earlier agents reported four small UI defects. Three reproduce on main. This PR fixes those three, each with a test that fails on main.

The fourth defect, an unstyled Not Found page, does not reproduce. #126 already fixed it.

What changed

• /bff/user now answers a signed-out visitor with 204 and no body. Before, it sent 401. A browser logs every 4xx response as a console error, and a signed-out visitor is a normal state. getUser reads 204 as signed out. A 4xx or 5xx status still shows the error toast.
• FilterControlDialog now owns the side padding of its control. A control pads itself for the desktop submenu popover. In the dialog, that padding came on top of the dialog's own 16 px. So text, multiselect, and date controls sat 16, 24, and 28 px from the edge. All five controls now sit 16 px from the edge.
• The bottom sheet of ResponsiveDialog now stops 4.5rem below the top of the screen. While a sheet is open on a phone, one toast shows at the top. At 667x375 the sheet was 85vh tall, and the toast covered the top 8 px of the sheet, the drag handle. The cap uses dvh, so it holds when the phone toolbar shows. A browser without dvh keeps the old 85vh. The toast timers are unchanged.

Scope

• The vertical padding of the filter controls in the sheet is unchanged. Only the side margins change.
• A toast with a description or a wrapped message is taller than 3rem. It can still touch the top of a tall sheet on a short screen.
• The Drawer and the bottom Sheet keep their heights.

Blast Radius

The 204 changes the wire contract of /bff/user. I updated each consumer in the repo: the BFF tests, the stack suite, the conformance runner, the verify skill, and the docs. A request without X-CSRF still gets 401. A tab that still runs the old bundle during a deploy shows a "status code 204" toast at its next auth refetch. The toast can show again on each later visit to Home, until the user reloads the page. In a rolling deploy with more than one BFF, a new SPA can get one 401 from an old BFF and show one toast. The padding change also aligns the filter edit dialog on a tablet or desktop with its title. The desktop submenus are pixel-identical.

Verification

• pnpm lint, pnpm build, pnpm test (84 passed), and pnpm test:e2e --workers=4 (53 passed). The new functional tests passed 10 out of 10 runs with --repeat-each=10.
• dotnet test --project tests/FullstackTemplate.Bff.Tests: 32 failures on main with the new tests, and 476 out of 476 pass with the fix.
• Real BFF on an isolated ZeroFactor stack. The login-logout recipe passed, and console.log and network.log stayed empty. pnpm test:e2e:stack gave 9 passed and 5 skipped by the provider.
• I compared screenshots of main and head at 320, 390, 768, and 1280 px, in light and dark mode. Only the filter sheets and the 768 px filter dialog changed. The other diffs were devtools-badge, focus-ring, and backdrop-blur noise, and a main-to-main run shows the same noise.

Filter sheets at 390 px, before and after (multiselect in light mode, date in dark mode):

Filter dialog at 768 px, before and after:

Tall sheet with a toast at 667x375, before and after:

[pdevito3]

Review findings that stay open, with the reason for each:

• A toast with a description or a wrapped message is about 4 to 5rem tall. On a 375 px tall landscape phone, it can still touch the top of a tall sheet. The fix covers the one-line toast. To cover every toast, the toaster would have to report its real height. That is more machinery than this defect justifies.
• A new SPA that talks to an old BFF during a rolling deploy gets 401 and shows one toast. The BFF serves the SPA, so this needs more than one BFF instance mid-deploy. I did not keep a compatibility branch for 401.
• doctor.sh fails against a stack that still runs the old BFF build. The doctor already warns when HEAD moved and says to rebuild the BFF.
• /bff/user sends no Cache-Control. That is also true on main and is not part of this change.