fix: site title reverts to 'DM Alerts' after Discord OAuth redirect

[hokiepokedad2]

Summary

• Load site settings after the OAuth callback stores the JWT token

Root cause

App.ngOnInit() calls settingsService.loadOnce() during bootstrap, but on the OAuth callback page, this fires before CallbackComponent extracts the JWT from the URL fragment and stores it in localStorage. The GET /api/settings request goes out without a Bearer token, gets a 401, and the error is silently swallowed. Since loaded stays false but nobody calls loadOnce() again, settings (including custom_title) are never loaded for the session.

Fix

Call settingsService.loadOnce() in handleTokenFromCallback() after the token is stored and user is loaded. The retry succeeds because the token is now in localStorage for the auth interceptor.

Closes #106

Test plan

• Set a custom site title in admin settings
• Log out and log back in via Discord OAuth
• After redirect, the custom title should appear immediately (not "DM Alerts")
• Subsequent page navigations should retain the custom title
• Direct page loads (already logged in) should still show the custom title

[hokiepokedad2]

Code Review: PR #111

Verdict: APPROVED ✓

Summary

Fixes the site title reverting to "DM Alerts" after Discord OAuth redirect by calling settingsService.loadOnce() in handleTokenFromCallback() after the JWT is stored.

Root Cause

Race condition: App.ngOnInit() fires loadOnce() before CallbackComponent stores the JWT → GET /api/settings returns 401 (silently swallowed) → loaded stays false → nobody retries → settings never load.

Category	Assessment
Correctness	Fix is correct. loadOnce() retries successfully since loaded is still false. The signal-based siteTitle reacts automatically.
Side effects	None — loadOnce() is idempotent. Short-circuits if already loaded.
Circular dependency	AuthService → SettingsService — safe, no reverse dependency.
Subscription leak	Fire-and-forget .subscribe() on a one-time HTTP call. No leak risk.
Tests	Updated to expect GET /api/settings after auth. 461 frontend + 560 backend tests pass.

Note

loadOnce().subscribe() is fire-and-forget — navigation to /dashboard doesn't wait for it. The title might flash "DM Alerts" very briefly. If noticeable, await firstValueFrom(this.settingsService.loadOnce()) before navigating would fix it. Not a blocker for now.

No issues found.