test(frontend): task dialog, sharing avatars, trash, API key scopes, passwords (FLAW-19)

Covers opening and closing the task dialog (the former hook-order bug),
date/time fields and the view-only mode for viewer lists, the avatar
stack of shared items, the two-tap delete in the trash, scope selection
and badges of API keys, and the shared password rule.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/features/settings/__tests__/ApiKeysPanel.test.tsx

@@ -0,0 +1,41 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { render, screen, fireEvent, act } from '@testing-library/react';
+
+const createAPIKey = vi.fn(async () => ({ id: 'k1', userId: 'u', name: 'HA', keyPrefix: 'mindsift_sec_ab', scopes: 'webhook:triage,webhook:list', createdAt: '' }));
+vi.mock('../../../lib/api', () => ({
+  api: {
+    getAPIKeys: vi.fn(async () => [
+      { id: 'k0', userId: 'u', name: 'Rauchmelder', keyPrefix: 'mindsift_sec_xy', scopes: 'webhook:triage,webhook:task', createdAt: '' },
+    ]),
+    getAllLists: vi.fn(async () => []),
+    getTaskLists: vi.fn(async () => []),
+    createAPIKey: (...args: unknown[]) => createAPIKey(...(args as [])),
+    deleteAPIKey: vi.fn(),
+    testWebhookIngest: vi.fn(),
+  },
+  triggerHaptic: vi.fn(),
+}));
+
+import { ApiKeysPanel } from '../ApiKeysPanel';
+
+describe('ApiKeysPanel', () => {
+  beforeEach(() => createAPIKey.mockClear());
+
+  it('shows the scopes of existing keys as badges', async () => {
+    render(<ApiKeysPanel />);
+    expect(await screen.findByText('Rauchmelder')).toBeTruthy();
+    expect(screen.getAllByText('📋 Aufgaben').length).toBeGreaterThan(1); // chip + badge
+  });
+
+  it('creates a key with the chosen scopes and never without one', async () => {
+    render(<ApiKeysPanel />);
+    const triage = screen.getByRole('checkbox', { name: /Triage/ });
+    fireEvent.click(triage); // last remaining scope cannot be switched off
+    expect(triage.getAttribute('aria-checked')).toBe('true');
+    fireEvent.click(screen.getByRole('checkbox', { name: /Listeneinträge/ }));
+    await act(async () => {
+      fireEvent.click(screen.getByRole('button', { name: /API-Key erzeugen/ }));
+    });
+    expect(createAPIKey).toHaveBeenCalledWith('Home Assistant', ['webhook:triage', 'webhook:list']);
+  });
+});