test(web): update auth-gate e2e specs for inline-retry token modal

The save flow no longer reloads — the dialog dismisses inline after the
parked /api/* requests succeed on retry. Update the existing spec to
match the new placeholder/button labels and 16-char minimum, and add two
new specs covering the validation error and the second-401 inline error
paths added in this PR.

https://claude.ai/code/session_01WjsbdUtxDJZL3GaAvhyzav

Author: claude

app/packages/web/e2e/specs/auth-gate.spec.ts

@@ -3,7 +3,8 @@ import { stubApis, ENV_DATA, COST_DATA } from '../fixtures/index.js';
 
 /**
  * Auth-gate specs use the base Playwright `test` (no pre-seeded token) so
- * they can verify the 401 → modal and token-save → reload flows in isolation.
+ * they can verify the 401 → modal and token-save → inline-retry flows in
+ * isolation.
  */
 
 test.describe('auth gate', () => {
@@ -26,7 +27,7 @@ test.describe('auth gate', () => {
     await expect(page.getByRole('heading', { name: 'API token required' })).not.toBeVisible();
   });
 
-  test('should save token and show dashboard after reload', async ({ page }) => {
+  test('should save token and dismiss modal without reloading', async ({ page }) => {
     // Playwright matches routes in REVERSE registration order, so register the
     // catch-all 404 FIRST and the specific 401/200 handlers after — otherwise
     // the catch-all takes precedence and the modal never triggers.
@@ -62,11 +63,43 @@ test.describe('auth gate', () => {
     await page.goto('/');
     await expect(page.getByRole('heading', { name: 'API token required' })).toBeVisible();
 
-    await page.getByPlaceholder('API token').fill('my-test-token');
-    await page.getByRole('button', { name: 'Save & reload' }).click();
+    // Inline validation requires ≥16 chars, no whitespace.
+    await page.getByPlaceholder('Paste API token').fill('my-test-token-12345');
+    await page.getByRole('button', { name: 'Save', exact: true }).click();
 
-    // After reload the stored token is sent; the modal must be gone.
+    // Modal dismisses inline (no reload) and the dashboard surfaces.
     await expect(page.getByRole('heading', { name: 'Game Server Manager' })).toBeVisible();
     await expect(page.getByRole('heading', { name: 'API token required' })).not.toBeVisible();
   });
+
+  test('should show inline validation error for a too-short token', async ({ page }) => {
+    await page.route('**/api/**', (route) =>
+      route.fulfill({ status: 401, body: 'Unauthorized' })
+    );
+    await page.goto('/');
+    await expect(page.getByRole('heading', { name: 'API token required' })).toBeVisible();
+
+    await page.getByPlaceholder('Paste API token').fill('short');
+    await page.getByRole('button', { name: 'Save', exact: true }).click();
+
+    await expect(page.getByText(/at least 16 characters/i)).toBeVisible();
+    // Modal stays open — validation never reached the network.
+    await expect(page.getByRole('heading', { name: 'API token required' })).toBeVisible();
+  });
+
+  test('should show inline server error when retry returns 401 again', async ({ page }) => {
+    await page.route('**/api/**', (route) =>
+      route.fulfill({ status: 401, body: 'Unauthorized' })
+    );
+    await page.goto('/');
+    await expect(page.getByRole('heading', { name: 'API token required' })).toBeVisible();
+
+    await page.getByPlaceholder('Paste API token').fill('still-the-wrong-token-1234');
+    await page.getByRole('button', { name: 'Save', exact: true }).click();
+
+    await expect(
+      page.getByText(/Invalid token — check `app\/server_config\.json` or `API_TOKEN`\./i),
+    ).toBeVisible();
+    await expect(page.getByRole('heading', { name: 'API token required' })).toBeVisible();
+  });
 });