fix(web): don't show the previous entity's data when the query changes (audit M18)

[passcod]

Fixes M18 (medium) from the audit in #370.

The bug

useApi keeps prior data on screen instead of flipping to loading, so a background refetch doesn't collapse the page to a placeholder. But the check was just prev.status === "ok" — no regard for whether that data belongs to the query now being made.

Detail routes reuse the mounted component across /servers/A → /servers/B, so A's name, health chip, checks and page title render under B's URL, with no loading indicator, for the whole fetch. On a slow connection that's seconds of confidently-wrong data about a different server — the failure mode gives the user no reason to distrust it.

The fix

Prior data is kept only when deps are unchanged — an actual refetch of the same query. A different identity goes to loading. deps arrays are new objects each render, so the comparison is element-wise Object.is.

VersionDetail's StatusControl also gets an explicit key={versionStr}. It seeds useState from detail.status once, so a reused instance carried the previous version's status into the new one with the Change button enabled — submitting would have written the stale status onto the new version. The parent's loading branch now unmounts it anyway, but the key makes that guarantee local rather than a side effect of how the parent happens to render.

Tests

private-web/src/api.test.tsx, using @testing-library/react's renderHook with a gated fetch stub so the window between "deps changed" and "new data arrived" is deterministic — no network throttling needed, which is what the audit rated hard.

• goes to loading when deps change to a different entity — confirmed to fail against the unfixed hook, which stays ok with server-1's data while identity B is in flight.
• keeps prior data across a reload of the same query — passes both ways; pins the behaviour the original code was there for.

Adds the vitest CI step and just test-web, since vitest was configured but never run in CI. That's the same hunk as the M17 branch (#443) — whichever lands first, the other resolves trivially.

---

Generated by Claude Code

[passcod]

CI caught a real regression in the first cut — pushed a fix in cccdf27.

provision-credential.spec.ts:44 failed because comparing the whole deps array was too strict. Callers force a refetch by bumping a nonce inside deps — DeviceDetail uses [id, tick] — which is the same entity, so my check read it as a new one, collapsed the subtree to <LinearProgress />, and unmounted ProvisionCredentialDialog mid-flow. The dialog holds the minted key in local state, so "Download key file" never appeared.

Verified it was mine and not flake: the test passes on main's api.ts and failed 3/3 with the deps comparison.

The fix compares what actually identifies the query — module, function, and params by value — so a refetch nonce isn't a new entity, while /servers/A → /servers/B still is. Added keeps prior data when only a refetch nonce in deps changes to pin the idiom.

Locally: 3/3 vitest, and the full Playwright suite green at 227 passed.

---

Generated by Claude Code