…ilures

Add RefreshHandler that validates the session cookie JWT, mints a fresh
JWT (with random jti for uniqueness), and returns 204 with the new
session cookie set. CORS headers are emitted before auth checks so the
SPA can read failure status codes from allowed origins. Also adds a
random jti to MintSessionJWT to ensure each minted token is unique even
when the clock hasn't advanced.

…ew/*

- Add StorageAPIURL to config.Config (required field, defaults to
  connection.keboola.com) so the STA verifier can be constructed.
- Add clock and staVerifier to apphandler.Manager; constructed in
  NewManager using d.Clock() and kaipreview.NewSTAVerifier().
- Add kaiPreview field to appHandler; constructed per-app in
  newAppHandler with a DevModeCheckerFunc backed by the live K8s
  state watcher.
- Insert kai-preview routing decisions in serveHTTPOrError (between
  the hostname-redirect and the existing internal URL routing):
    1. /_proxy/kai-preview/* -> kai-preview composite handler
    2. Valid session cookie -> forward to upstream, skip AuthRules
       (TODO T15: sliding refresh)
    3. Sec-Fetch-Dest=iframe with no session -> serve bootstrap shim
  - Falls through to existing AuthRules when DevMode is false.
- Add isDevMode() helper that re-reads live K8s cache per request.
- Update mocked dependency scope to auto-populate StorageAPIURL and
  KaiPreview signing keys for test configurations.
- Add scaffolded integration test (t.Skip) in apphandler package.
- Add three real integration tests to proxy_test.go: bootstrap on
  dev-mode app, fall-through on non-dev-mode app, and iframe
  bootstrap fallback detection.

…eAPIURL at startup

Extend DevModeChecker.IsDevMode to accept a context.Context so that request
trace IDs propagate through to AppInfo log lines instead of being dropped via
context.Background(). Update DevModeCheckerFunc, all three endpoint handlers
(embed_token, exchange, refresh), their test stubs, and the apphandler closure.

Replace the StorageAPIURL nil-guard in manager.NewManager with an explicit
panic so misconfiguration surfaces at startup rather than silently producing
an empty URL.

Delete the scaffolded kaipreview_integration_test.go; real integration tests
belong in proxy_test.go alongside the existing kai-preview fixtures.

When a request arrives with a valid kai-preview session cookie whose age
has passed the TTL midpoint (NeedsRefresh == true), the proxy mints a
fresh JWT and emits Set-Cookie on the response before forwarding to
upstream. Replaces the TODO(T15) stub added in T14.

Adds TestKaiPreviewSlidingRefresh: a focused regression test that injects
a FakeClock, asserts no Set-Cookie before midpoint (t+1h / 4h TTL), and
confirms Set-Cookie with a valid fresh JWT appears after midpoint (t+3h).

Add operator-facing documentation for the kai-preview iframe-auth flow,
covering endpoint reference, config keys, routing decision tree,
multi-replica stateless behavior, and a step-by-step smoke-test runbook
(Tasks 16 + 17).

…nbook

… dev-mode gate

Strip trailing slashes from AllowedIDEOrigins in KaiPreview.Normalize() to
prevent silent CORS failures when operators configure origins with a trailing
slash (browsers send Origin headers without one). Add an internal IsDevMode
guard to BootstrapHandler matching the pattern of the other three handlers.

Unifies endpoint, handler, and constant naming with the existing
HandshakeClaims/MintHandshakeJWT/purposeHandshake symbols. The purpose
claim value changes from "kai-preview-embed" to "kai-preview-handshake".

Replace the opaque "STA" prefix throughout the kai-preview feature with
the clearer "StorageToken" naming. The interface carries the canonical
name (StorageTokenVerifier), the HTTP-backed impl gets a kind-specific
name (HTTPStorageTokenVerifier), and all fields, locals, tests, error
strings, and docs are updated to match.

Files renamed via git mv:
  sta_verifier.go       → storage_token_verifier.go
  sta_verifier_test.go  → storage_token_verifier_test.go

…ndler

Fix all 52 golangci-lint failures reported by CI run 25903961499:

- noctx(25): replace httptest.NewRequest → NewRequestWithContext(t.Context(), …) in all kaipreview test files
- tagliatelle(3): rename JSON tags app_id → appId and ttl_s → ttlS in jwt.go (HandshakeClaims, SessionClaims)
- errchkjson(7): check errors from json.Marshal / json.NewEncoder().Encode() in bootstrap.go, handshake_token.go, exchange_test.go, storage_token_verifier_test.go
- nilerr(4): add //nolint:nilerr with explanation where HTTP handlers deliberately swallow errors
- gochecknoglobals(2): var PathPrefix → const PathPrefix in handler.go; //nolint:gochecknoglobals on bootstrapTmpl
- gci(4): fix struct-field alignment in manager.go / apphandler.go; add missing spaces after commas in cookie_test.go, cors_test.go
- contextcheck(2): add //nolint:contextcheck on the two false-positive req.Context() call sites in apphandler.go; extract serveKaiPreview helper to reduce nestif complexity
- paralleltest(1)+tparallel(1): add t.Parallel() to TestIsIframeDocumentLoad subtests
- testifylint(1): assert.False(strings.Contains(…)) → assert.NotContains(…)
- errname(1): rename stubErr → stubError in handshake_token_test.go
- gosec G203(1): //nolint:gosec on template.JS(bs) conversion in bootstrap.go
- unparam(1): remove unused devMode bool param from newTestCompositeHandler; inline true
- usetesting(6): context.Background() → t.Context() in storage_token_verifier_test.go

Replace GetFreePort()+Listen() with a direct Listen("127.0.0.1:0") so
the OS assigns a free port atomically, removing the TOCTOU window where
a parallel test could steal the port between the two calls.