P1 complete: web front, test suite, CI — acceptance ALL GREEN

Fan-out integration + fixes found by the test/acceptance pass:
- FIX ring-buffer: chunks >= capacity skipped bytes now count into the
  monotonic offset (invariant: stream byte k lives at k % capacity) —
  window order was corrupted on unaligned big chunks
- FIX auth: non-numeric cookie expiry no longer bypasses expiration
- FIX protocol: safe-integer validation on ack.bytes / hello.protocol
- FIX @fastify/websocket v11: websocket route must be registered in an
  encapsulated context after plugin load (handler got REST signature)
- FIX flow-control deadlock found by e2e acceptance: client only ACKs
  on data receipt, so pausing with an unACKed residue in (LOW,
  ACK_EVERY] stalled both sides at 0.9 MB. ACK_EVERY now 64 KiB (<=
  LOW invariant, tested) + trailing debounced ACK in the web client
- Web: Vue 3 + Vite + Pinia + Tailwind 4 + vue-i18n (EN/FR) + xterm 6
  (fit + webgl fallback), multiplexed ws-client with reconnect/backoff
  and resync epochs
- Tests: 100 vitest (protocol fuzz, ring edges, auth, pty-manager flow
  control with mocked pty, REST e2e) ; CI Node 22/24 + pack-smoke
- scripts/acceptance-p1.mjs: real daemon + real WS client — boot,
  login, attach, stdin, 10 MB flood w/ ACK (13.7 MB/1.9s, RSS bounded),
  brutal disconnect + replay resync, kill broadcast, SIGTERM drain

packages/server/src/app.ts

@@ -73,7 +73,11 @@ export function buildApp(config: Config, db: Db, serverVersion: string): AppBund
 
   registerAuthRoutes(app, auth, limiter, serverVersion);
   registerSessionRoutes(app, manager);
-  registerWsGateway(app, manager, serverVersion);
+  // La route websocket doit être déclarée APRÈS le chargement du plugin (contexte
+  // encapsulé) — sinon le handler reçoit la signature REST (request, reply).
+  void app.register(async (scoped) => {
+    registerWsGateway(scoped, manager, serverVersion);
+  });
 
   // SPA buildée embarquée dans le paquet npm (public/) — absente en dev (vite dev sert le front)
   const publicDir = join(dirname(fileURLToPath(import.meta.url)), '..', 'public');

packages/server/src/auth/service.ts

@@ -69,7 +69,9 @@ export class AuthService {
     const expected = this.sign(payload);
     if (sig.length !== expected.length || !timingSafeEqual(Buffer.from(sig), Buffer.from(expected))) return null;
     const [tokenId, expiresStr] = payload.split('.');
-    if (!tokenId || !expiresStr || Number(expiresStr) < Date.now()) return null;
+    if (!tokenId || !expiresStr) return null;
+    const expires = Number(expiresStr);
+    if (!Number.isFinite(expires) || expires < Date.now()) return null;
     const row = this.db
       .prepare('SELECT id, label FROM auth_tokens WHERE id = ? AND revoked_at IS NULL')
       .get(tokenId) as { id: string; label: string } | undefined;

packages/server/src/core/pty-manager.ts

@@ -244,14 +244,13 @@ export class PtyManager extends EventEmitter<PtyManagerEvents> {
   private handleExit(s: ManagedSession, exitCode: number | null, signal: number | null): void {
     s.exited = { exitCode, signal };
     if (s.killTimer) clearTimeout(s.killTimer);
-    this.db
-      .prepare('UPDATE sessions SET ended_at = ?, exit_code = ? WHERE id = ?')
-      .run(new Date().toISOString(), exitCode, s.id);
+    const endedAt = new Date().toISOString();
+    this.db.prepare('UPDATE sessions SET ended_at = ?, exit_code = ? WHERE id = ?').run(endedAt, exitCode, s.id);
     for (const c of s.clients) c.onDetached('session_exit');
     s.clients.clear();
     this.live.delete(s.id);
     this.emit('session_exit', { sessionId: s.id, exitCode, signal });
-    this.emit('session_update', { ...this.summarize(s), live: false, status: 'exited' });
+    this.emit('session_update', { ...this.summarize(s), live: false, status: 'exited', endedAt });
   }
 
   private summarize(s: ManagedSession): SessionSummary {

packages/server/src/core/ring-buffer.ts

@@ -22,20 +22,23 @@ export class RingBuffer {
   }
 
   write(chunk: Buffer): void {
+    // Chunk plus grand que la fenêtre : on ne stocke que la queue, mais en comptant
+    // les octets sautés dans l'offset pour préserver l'invariant « l'octet k du flux
+    // est à la position k % capacity » (sinon tail/readFrom rendent la fenêtre désordonnée).
     if (chunk.length >= this.capacity) {
-      chunk.copy(this.buf, 0, chunk.length - this.capacity);
-      this.length = this.capacity;
-    } else {
-      const writePos = this.total % this.capacity;
-      const tailSpace = this.capacity - writePos;
-      if (chunk.length <= tailSpace) {
-        chunk.copy(this.buf, writePos);
-      } else {
-        chunk.copy(this.buf, writePos, 0, tailSpace);
-        chunk.copy(this.buf, 0, tailSpace);
-      }
-      this.length = Math.min(this.capacity, this.length + chunk.length);
+      const skipped = chunk.length - this.capacity;
+      this.total += skipped;
+      chunk = chunk.subarray(skipped);
     }
+    const writePos = this.total % this.capacity;
+    const tailSpace = this.capacity - writePos;
+    if (chunk.length <= tailSpace) {
+      chunk.copy(this.buf, writePos);
+    } else {
+      chunk.copy(this.buf, writePos, 0, tailSpace);
+      chunk.copy(this.buf, 0, tailSpace);
+    }
+    this.length = Math.min(this.capacity, this.length + chunk.length);
     this.total += chunk.length;
   }