Fix coverage status card (shields.io CORS redirect)

[super3]

Problem

On dashban.com the browser console shows:

Access to fetch at 'https://img.shields.io/coverallsCoverage/github/super3/dashban.svg?...&branch=main'
(redirected from 'https://img.shields.io/coveralls/github/super3/dashban/main.svg?...')
blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present
status-cards.js: Error fetching coverage status: TypeError: Failed to fetch

shields.io deprecated the /coveralls/ badge path. It now 301-redirects to a /coverallsCoverage/...svg URL whose response carries no Access-Control-Allow-Origin header (it returns 408 for that variant), so the browser blocks fetchCoverageStatus from reading the SVG body cross-origin. The coverage card silently falls back to "unknown".

This is pre-existing and unrelated to the recent Clerk auth work (#72) — it only surfaced when looking at the console.

Fix

Point buildBadgeUrl('coverage') at the current non-redirecting endpoint:

https://img.shields.io/coverallsCoverage/github/super3/dashban?branch=main

Verified: returns 200 with access-control-allow-origin: * and a parseable SVG body. The cache-buster is now joined with & since this URL already carries ?branch=main.

Testing

• npm test — 959 passing (updated the two status-cards assertions for the new URL).
• npm run test:coverage — 100% across all files (status-cards.js included).
• npm run lint — 0 errors (7 pre-existing warnings unchanged).

🤖 Generated with Claude Code

https://claude.ai/code/session_019VQjXJyM3EZPd4joy3EwaB

---

Generated by Claude Code