fix: red-team round 3 hardening across desktop, mobile, core and server

Batch of red-team r3 fixes that were in the working tree before the
2026-09-28 design overhaul, committed as one unit with their tests.

- desktop main: STT timeouts and sidecar, voice recording store, sync
  (credentials, audio, knowledge reindex, push gates), runtime
  provisioner, update policy, AltGr keybindings, voice-command policy,
  dictionary file codec/limits, meeting transcript condensing and a
  local recording ledger so interrupted-session recovery only closes
  meetings this device recorded (a phone's live meeting is left alone).
- mobile: login CSRF via implicit token callbacks rejected, account
  deletion/retention, durable queue retention, knowledge realtime
  without unfiltered DELETE, meeting re-record failure paths, cloud STT
  client, preferences store/resync.
- core: text chunking splits long unbroken transcripts to fit, template
  field policy, dictionary limits, meeting markdown inline handling.
- server: payple webhook policy and cancellation order scope, meeting
  document generation quota, team RPC null-role guard, unified LLM
  quota in-flight accounting, knowledge chunk vector index, meeting
  re-record failure paths (migrations 20260929*).
- ci: portable/runtime feed gates, update-policy schema, Forgejo file
  delete and alias planning.

Four older tests are updated to the new contracts rather than the old
behavior: token-pair auth callbacks are rejected, knowledge realtime no
longer subscribes to DELETE, long transcript lines are split, and
meeting recovery requires the local recording ledger for empty rows.

packages/api-client/__tests__/public-surface-r2-35.test.ts

@@ -2,10 +2,65 @@
 // 루트 barrel은 공유 계약(타입 + 클라이언트 팩토리)만 공개해야 한다.
 // 앱마다 따로 소유하는 저장소·쿼터·STT 호출 헬퍼가 '정본처럼' 다시 노출되지 않도록 고정한다.
 
+import { existsSync, readFileSync } from 'node:fs'
+import { dirname, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
 import { describe, expect, expectTypeOf, it, vi } from 'vitest'
 import * as apiClient from '../src/index'
 import type { TranscribeAudioResult } from '../src/index'
 
+const PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+
+interface ExportConditions {
+  types?: string
+  default?: string
+}
+
+interface PackageManifest {
+  main?: string
+  types?: string
+  exports: Record<string, ExportConditions | string>
+}
+
+function readManifest(): PackageManifest {
+  return JSON.parse(readFileSync(resolve(PACKAGE_ROOT, 'package.json'), 'utf8')) as PackageManifest
+}
+
+function exportTargets(entry: ExportConditions | string): string[] {
+  return typeof entry === 'string' ? [entry] : Object.values(entry).filter((v): v is string => typeof v === 'string')
+}
+
+describe('@d3ro/api-client exports map', () => {
+  it('publishes exactly the shared-contract subpaths', () => {
+    expect(Object.keys(readManifest().exports).sort()).toEqual([
+      '.',
+      './client',
+      './supabase-browser',
+      './supabase-server',
+    ])
+  })
+
+  it('does not publish app-owned runtime policy subpaths', () => {
+    const subpaths = Object.keys(readManifest().exports)
+    for (const removed of ['./auth', './meetings', './history', './usage', './transcribe']) {
+      expect(subpaths, removed).not.toContain(removed)
+    }
+  })
+
+  it('points every declared target (exports, main, types) at an existing file', () => {
+    const manifest = readManifest()
+    const targets = [
+      ...Object.values(manifest.exports).flatMap(exportTargets),
+      ...(manifest.main ? [manifest.main] : []),
+      ...(manifest.types ? [manifest.types] : []),
+    ]
+    expect(targets.length).toBeGreaterThan(0)
+    for (const target of targets) {
+      expect(existsSync(resolve(PACKAGE_ROOT, target)), target).toBe(true)
+    }
+  })
+})
+
 describe('@d3ro/api-client root surface', () => {
   it('exposes only the client factory runtime values', () => {
     expect(Object.keys(apiClient).sort()).toEqual([

packages/api-client/package.json

@@ -19,22 +19,6 @@
       "types": "./src/client.ts",
       "default": "./src/client.ts"
     },
-    "./auth": {
-      "types": "./src/auth.ts",
-      "default": "./src/auth.ts"
-    },
-    "./meetings": {
-      "types": "./src/meetings.ts",
-      "default": "./src/meetings.ts"
-    },
-    "./history": {
-      "types": "./src/history.ts",
-      "default": "./src/history.ts"
-    },
-    "./usage": {
-      "types": "./src/usage.ts",
-      "default": "./src/usage.ts"
-    },
     "./supabase-browser": {
       "types": "./src/supabase-browser.ts",
       "default": "./src/supabase-browser.ts"

packages/api-client/src/auth.ts

@@ -1,58 +0,0 @@
-// packages/api-client/src/auth.ts
-// Supabase Auth 래퍼. OAuth, session, 로그아웃.
-
-import type { Session, User, Provider } from '@supabase/supabase-js'
-import type { D3roSupabaseClient } from './client'
-
-export type { Session, User }
-
-export interface SignInOptions {
-  provider: Extract<Provider, 'google' | 'github' | 'apple'>
-  redirectTo: string
-}
-
-export async function signInWithOAuth(
-  client: D3roSupabaseClient,
-  options: SignInOptions
-): Promise<{ url: string | null; error: string | null }> {
-  const { data, error } = await client.auth.signInWithOAuth({
-    provider: options.provider,
-    options: {
-      redirectTo: options.redirectTo
-    }
-  })
-  return {
-    url: data?.url ?? null,
-    error: error?.message ?? null
-  }
-}
-
-export async function signOut(client: D3roSupabaseClient): Promise<{ error: string | null }> {
-  const { error } = await client.auth.signOut()
-  return { error: error?.message ?? null }
-}
-
-export async function getSession(client: D3roSupabaseClient): Promise<Session | null> {
-  const { data } = await client.auth.getSession()
-  return data.session ?? null
-}
-
-export async function getUser(client: D3roSupabaseClient): Promise<User | null> {
-  const { data } = await client.auth.getUser()
-  return data.user ?? null
-}
-
-/**
- * 세션 변경 구독. 반환된 함수를 호출하면 구독 해제.
- */
-export function onAuthStateChange(
-  client: D3roSupabaseClient,
-  callback: (session: Session | null) => void
-): () => void {
-  const { data } = client.auth.onAuthStateChange((_event, session) => {
-    callback(session)
-  })
-  return () => {
-    data.subscription.unsubscribe()
-  }
-}