fix(auth,dashboard): pr #194 coderabbit remediation (sfU + se1)

sfU (account enumeration): the signUp fallback in `handleFormSubmit`
surfaces raw Supabase error messages. When an attacker enters a
registered email with a wrong password, signIn fails with "Invalid
login credentials" and the code falls back to signUp, which throws
"User already registered" — leaking account existence to the caller.
Detect that class of message via regex and surface the same generic
credential error as a failed login, so the error reveals nothing.

se1 (stale dashboard after save): `registrarHistoricoTreinoAction` calls
`revalidatePath('/aluno/dashboard')`, which invalidates the cache but
does not update this already-mounted client component's `aluno` props.
Add `router.refresh()` after a successful save so the RSC payload is
re-fetched and XP/level/streak/treinosNoMes reflect the new state
without a manual reload. Mock `next/navigation` in
`dashboard-client.test.tsx` to satisfy `useRouter`.

Tests: 1151 pass, 0 fail. Typecheck + lint clean.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: EmiyaKiritsugu3

src/app/aluno/dashboard/dashboard-client.test.tsx

@@ -27,6 +27,10 @@ vi.mock('motion/react', () => ({
   },
 }));
 
+vi.mock('next/navigation', () => ({
+  useRouter: () => ({ refresh: vi.fn() }),
+}));
+
 vi.mock('@/components/ui/card', () => ({
   Card: ({ children, className }: { children: ReactNode; className?: string }) => (
     <div className={className}>{children}</div>

src/app/aluno/dashboard/dashboard-client.tsx

@@ -1,6 +1,7 @@
 'use client';
 
 import React, { useState } from 'react';
+import { useRouter } from 'next/navigation';
 import { motion } from 'motion/react';
 import { Card } from '@/components/ui/card';
 import { Trophy, Zap, Target, Award } from 'lucide-react';
@@ -29,6 +30,7 @@ export default function AlunoDashboardClient({
 }: Readonly<AlunoDashboardClientProps>) {
   const notify = useAppNotification();
   const { t } = useI18n();
+  const router = useRouter();
 
   const [feedback, setFeedback] = useState<{ title: string; message: string } | null>(null);
   const [isFeedbackLoading, setIsFeedbackLoading] = useState(false);
@@ -85,6 +87,10 @@ export default function AlunoDashboardClient({
       const res = await registrarHistoricoTreinoAction(historico);
       if (res.success) {
         notify.success('Treino Finalizado!', 'Seu progresso e XP foram salvos!');
+        // revalidatePath in the action invalidates the cache but this mounted
+        // client keeps stale `aluno` props (XP/level/streak). router.refresh()
+        // re-fetches the RSC payload so the dashboard reflects the new state.
+        router.refresh();
       } else {
         throw new Error(res.error);
       }

src/app/aluno/login/page.tsx

@@ -96,12 +96,18 @@ export default function AlunoLoginPage() {
       notify.success('Login bem-sucedido!');
       router.push('/aluno/dashboard');
     } catch (error: unknown) {
-      const message =
+      const rawMessage =
         error instanceof Error
           ? error.message
           : typeof error === 'object' && error && 'message' in error
             ? String((error as { message: unknown }).message)
             : 'Erro desconhecido';
+      // Avoid account enumeration: if the signUp fallback discovers the email
+      // is already registered, surface the same generic credential error as a
+      // failed login rather than leaking "User already registered" to callers.
+      const message = /already\s+(been\s+)?registered|user\s+already/i.test(rawMessage)
+        ? 'E-mail ou senha inválidos. Por favor, tente novamente.'
+        : rawMessage;
       setAuthError(message);
     } finally {
       setIsLoading(false);