CI: green up the test + frontend jobs

Two unrelated breakages, both diagnosed via a github.com/actions
walk after the user noticed every CI run since the redesign merge
has been red:

Python — `tests/test_error_handling_scenarios.py`
  The two `admin_refresh_*` scenarios POST to
  /api/admin/refresh-cache and assert 401/403. They passed
  locally because `.env` in the repo root populates
  REFRESH_CACHE_SECRET, so the endpoint reaches the bearer-check
  branch. CI does not load that .env, so REFRESH_CACHE_SECRET
  ends up empty and the route's "fail closed" path returns 503
  ("Refresh-cache secret not configured on the server.") — never
  exercising the assertion path.

  Split the two scenarios out of the parametrized list into
  standalone test functions that take `monkeypatch` and patch
  `backend.routers.jobs.REFRESH_CACHE_SECRET = "test-secret"`
  before invoking the scenario. The other 9 scenarios stay in
  the parametrized list since they don't need the secret.

Frontend — `frontend/src/components/workspace/WorkspaceShell.tsx`
  The `jd_summary` projection added in commit `e741549`
  ("Assistant: thread live workspace state into every query")
  referenced field names that don't exist on the `JobReview`
  type. Specifically:

    - `review.title`           → JobReview has no title field
    - `review.location`        → no location field either
    - `review.requirements.*`  → no requirements field; the
                                  parsed-text breakdown lives at
                                  the top level as
                                  `hardSkills` / `softSkills`
                                  / `mustHaves`

  TypeScript blocks the Next.js build on this. The Vercel/dev
  server happens to run with looser types so it kept working
  locally; CI's `next build` (full type check) failed.

  Fix: pull title + location from `activeJob` (the JobPosting
  metadata, which DOES have those structured fields) and use
  the correct flat field names from JobReview for the counts.
  When the user pasted a JD manually (no JobPosting), title +
  location come up empty; the LLM still gets the skill counts.

Verified locally:
  - tests/test_error_handling_scenarios.py: 14/14 pass
  - npx tsc --noEmit: 0 errors
  - Build & Deploy was always green (only test+frontend in CI
    were red), so production was never affected by either bug.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: LEANDERANTONY

frontend/src/components/workspace/WorkspaceShell.tsx

@@ -1355,13 +1355,22 @@ export function WorkspaceShell() {
             }
           : null,
         has_jd: Boolean(review),
+        // Title + location come from the JobPosting metadata (when
+        // the user picked a job from search). Skill counts come from
+        // the JobReview's parsed-text breakdown. They live on
+        // different objects on purpose: review.{hardSkills,softSkills,
+        // mustHaves} is the local heuristic parse of the JD body,
+        // whereas activeJob.{title,location} is the structured
+        // metadata from the ATS source. activeJob is null on a
+        // manually-pasted JD, in which case title/location simply
+        // come up empty — the LLM still gets the skill counts.
         jd_summary: review
           ? {
-              title: review.title || "",
-              location: review.location ?? null,
-              hard_skills_count: review.requirements?.hard_skills?.length ?? 0,
-              soft_skills_count: review.requirements?.soft_skills?.length ?? 0,
-              must_haves_count: review.requirements?.must_haves?.length ?? 0,
+              title: activeJob?.title ?? "",
+              location: activeJob?.location ?? null,
+              hard_skills_count: review.hardSkills?.length ?? 0,
+              soft_skills_count: review.softSkills?.length ?? 0,
+              must_haves_count: review.mustHaves?.length ?? 0,
             }
           : null,
         has_analysis: Boolean(analysisState),

tests/test_error_handling_scenarios.py

@@ -314,8 +314,14 @@ def _scenario_assistant_answer_unknown_action():
     ("artifact_export_unsupported_format", _scenario_artifact_export_unsupported_format),
     ("workspace_analyze_empty_body", _scenario_workspace_analyze_empty_body),
     ("analyze_jobs_status_missing_job", _scenario_analyze_jobs_status_missing_job),
-    ("admin_refresh_without_bearer", _scenario_admin_refresh_without_bearer),
-    ("admin_refresh_invalid_bearer", _scenario_admin_refresh_invalid_bearer),
+    # The two admin-refresh bearer scenarios live as separate test
+    # functions below — they need a `monkeypatch` to set the
+    # REFRESH_CACHE_SECRET. Without it the endpoint returns 503
+    # ("Refresh-cache secret not configured") and the bearer-check
+    # branches we're trying to exercise never run. (Local dev
+    # happens to pass because `.env` populates the secret; CI
+    # doesn't ship a `.env`, so the parametrized form failed
+    # only in CI.)
     ("resume_builder_export_400_real_message", _scenario_resume_builder_export_returns_400_with_real_message),
     ("save_workspace_unauthenticated", _scenario_save_workspace_unauthenticated),
     ("assistant_answer_unknown_action", _scenario_assistant_answer_unknown_action),
@@ -327,6 +333,23 @@ def test_error_scenario(name, scenario_fn):
     scenario_fn()
 
 
+def test_admin_refresh_without_bearer(monkeypatch):
+    """Endpoint must reject an unauthenticated POST with 401/403.
+
+    Patches REFRESH_CACHE_SECRET so the bearer-check branch is
+    actually reached (without a configured secret the endpoint
+    short-circuits with a 503).
+    """
+    monkeypatch.setattr("backend.routers.jobs.REFRESH_CACHE_SECRET", "test-secret")
+    _scenario_admin_refresh_without_bearer()
+
+
+def test_admin_refresh_invalid_bearer(monkeypatch):
+    """Endpoint must reject a wrong bearer with 401."""
+    monkeypatch.setattr("backend.routers.jobs.REFRESH_CACHE_SECRET", "test-secret")
+    _scenario_admin_refresh_invalid_bearer()
+
+
 def test_resume_upload_with_invalid_base64(monkeypatch):
     _scenario_resume_upload_with_invalid_base64(monkeypatch)