feat: sync CLI with dashboard@v1.0.3

[cursor]

Upstream

• Dashboard release: v1.0.3
• SHA: 6ac15f95d097b802a6c9b09865b647c9c2c214cd

Routes added (12)

• GET .well-known.openid-configuration.api.auth
• POST api.account.set-password
• PATCH api.oauth-clients.:clientId.metadata
• GET api.oauth-clients.:clientId.scope-tiers
• GET api.oauth-clients.authorized
• DELETE api.oauth-clients.authorized.:clientId
• POST api.privacy-requests
• GET api.projects
• POST api.projects.:id.slack.setup
• POST api.signup.abandon
• GET api.slack.features
• GET .well-known.oauth-authorization-server.api.auth

Routes removed (3)

• POST api.otp.email.send
• POST api.otp.email.verify
• GET api.projects (schema-only rename; new flat route added above)

No CLI code referenced the removed OTP routes (signup/email verification is dashboard-only), so no command or DTO updates were required.

Routes changed

(none)

Snapshot changes

(none)

New runtime dependencies

(none)

Verification

bun run check (typecheck + 33 tests + build) is green.

  

---

^{Need help on this PR? Tag @codesmith with what you need. Autofix is disabled.}

[github-actions]

Agent PR Review

Scenario: C — re-review after synchronize event (empty re-trigger commit af17bf2)
Verdict: ✅ Approve

What's right

• Only types/api.d.ts (vendored) and UPSTREAM_DIFF.md changed — exactly what bun run sync:api produces.
• Removed routes (otp.email.send/verify, schema-only api.projects rename) have zero references under src/ or tests/ — grep -rE "(otp\.email|email\.send|email\.verify)" src/ tests/ is empty.
• The new flat api.projects GET route is already what src/commands/projects.ts calls (api.api.projects.get()), so the schema rename is a no-op for the CLI.
• No package.json / bun.lock / .github/workflows/ / scripts/agent-flow/ changes. No forbidden deps.
• bun install --frozen-lockfile && bun run check clean locally: tsc passes, 33/33 tests pass, build emits dist/photon.js.
• PR body honestly accounts for snapshot changes (none), new deps (none), and acknowledges the removed routes weren't wired up.
• One PR = one upstream bump (dashboard v1.0.3, SHA 6ac15f9).

Concerns

• None.

Deferred (acknowledged in PR body)

• 12 new routes (oauth-clients authorized list/delete/metadata/scope-tiers, account.set-password, signup.abandon, privacy-requests, projects/:id/slack/setup, slack/features, two .well-known endpoints) are typed but not yet surfaced as CLI commands. Appropriate — none are part of the existing CLI surface, and adding them would violate "one PR = one upstream bump."

Final note

Re-trigger commit af17bf2 is an empty commit; the substantive content is unchanged from 2a7e53d. Marked ready and approved.