feature: migrate Conduit frontend from Angular v21 to React (Vite + TS)

[devin-ai-integration]

Summary

Full rewrite of the RealWorld "Conduit" frontend from Angular v21 to React 18 + TypeScript + Vite, preserving identical routes, behavior, validation, auth flows, and API integration against https://api.realworld.show/api. Package manager stays Bun; the realworld submodule (theme CSS + SVG assets) is reused unchanged and wired into Vite via vite-plugin-static-copy.

The Angular building blocks map to React as follows:

Angular	React
3 HTTP interceptors (api / token / error)	one axios instance in src/core/api/api-client.ts (baseURL prefix, Authorization: Token <jwt> request interceptor, response interceptor: 401 on non-/user → purgeAuth, normalizeError → { ...body, status } with network fallback)
UserService (RxJS subjects)	UserProvider context in src/core/auth/user-context.tsx
JwtService	src/core/auth/jwt.ts (localStorage jwtToken)
*ifAuthenticated structural directive	<IfAuthenticated when={bool}> + useIsAuthenticated()
route canActivate guards	<RequireAuth> / <RedirectIfAuthenticated> wrappers
ReactiveFormsModule	react-hook-form
markdown/defaultImage pipes	src/shared/* helpers (marked + DOMPurify)

Auth model is preserved exactly: 4 states (loading | authenticated | unauthenticated | unavailable), 4XX-vs-5XX distinction on GET /user (4XX → logout, 5XX → unavailable), exponential-backoff auto-retry (2s→4s→8s→16s cap), and the window.__conduit_debug__ contract (getToken/getAuthState/getCurrentUser) that the e2e suite depends on.

Notable fixes in this PR (beyond the initial scaffold)

• article-list.tsx: guard the feed response so a malformed/empty (204) /articles body can't crash the app — data.articles/articlesCount are validated before setResults, otherwise results.length in render threw and blanked the page.

  const articles = Array.isArray(data?.articles) ? data.articles : [];
  const articlesCount = typeof data?.articlesCount === 'number' ? data.articlesCount : 0;

• settings.tsx: omit password from the PUT /user payload when the field is blank (the API 422s on an empty password string), so a bio/image-only update succeeds and navigates to /profile/:username.
• deploy.yml: zip from dist/ (Vite output) instead of dist/angular-conduit/browser.

Testing

• bun run build, bun run typecheck, bun run format:check — clean.
• Unit tests (Vitest): 15/15 pass across 6 files.
• Security e2e (test:e2e:security): 16/16 pass (XSS sanitization).
• Playwright e2e (test:e2e): 121/122 pass.

Known failing e2e test (pre-existing test bug, not an app defect)

error-handling.spec.ts:63 "should handle 400 on article creation" mocks POST https://api.realworld.show/api/articles without a trailing slash, but the article-create endpoint has always been /articles/ with a trailing slash (unchanged from the original Angular articles.service.ts). Playwright matches URLs with trailing-slash sensitivity, so the mock never matches and the request hits the live API (401 → logout → redirect to /login), so .error-messages never renders.

This is contradictory with error-handling.spec.ts:617, which mocks POST .../articles/ with the trailing slash and requires the app to use that exact URL. No single URL can satisfy both, so I preserved the original app's /articles/ behavior (keeping test 617 green and matching the source app). Validation-error display itself works — it's exercised and green via other error-handling tests.

Link to Devin session: https://app.devin.ai/sessions/bdf12282ffbb4a49b5ce370d920133f5
Requested by: @jerryoliphant-cog

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring