Stabilize dependency restores and frontend build validation

[therobbiedavis]

Summary

This PR gets the dependency validation loop back into a trustworthy state. The main fix is making NuGet restores deterministic for the backend so local and CI runs resolve the same package graph before dotnet test --no-restore runs.

While validating the dependency graph, I also pulled in the existing dependency update branch and cleaned up the frontend build warnings that surfaced from that validation. The frontend changes are intentionally small: remove one avoidable router/auth dynamic import warning, and filter a known upstream @vueuse/core Rolldown annotation warning without hiding unrelated build warnings.

The CI publish path is covered too: the API project now declares the runtime identifiers used by release/test workflows, the API lock file includes those runtime targets, and publish steps use the already-restored graph with --no-restore.

Refs #677.

Changes

Added

• NuGet packages.lock.json files for the backend projects and test project.
• Runtime-specific API lock targets for linux-x64, linux-arm64, win-x64, and osx-x64.
• A small frontend router instance service so non-component code can use the already-created router without dynamically importing the router module.

Changed

• Enabled NuGet lock files and CI locked restore mode in Directory.Packages.props.
• Declared the API publish runtime identifiers in Listenarr.Api.csproj.
• Updated CI publish steps to use --no-restore after the locked restore step.
• Pulled in the root and frontend dependency updates from chore/dependency-update, including the Node engine update to ^24.15.0.
• Updated the auth store to use the shared router instance instead of dynamically importing @/router.
• Added a narrow Vite/Rolldown log filter for known upstream @vueuse/core pure annotation noise.

Fixed

• Fixed backend test compilation failing from inconsistent package resolution, especially the EF Core 10.0.7 / 10.0.8 drift.
• Fixed locked restore coverage for RID-specific publish targets used by GitHub Actions.
• Fixed the frontend production build warning about an ineffective dynamic import between the auth store and router.
• Kept the frontend production build warning-free after the dependency update.

Testing

• dotnet restore listenarr.slnx /p:CI=true
• dotnet test listenarr.slnx --no-restore
  • 695 passed
• dotnet publish listenarr.api/Listenarr.Api.csproj -c Release -r linux-x64 --no-restore --self-contained true /p:PublishSingleFile=true /p:SkipFrontendBuild=true -o artifacts/publish-check/linux-x64
• dotnet publish listenarr.api/Listenarr.Api.csproj -c Release -r win-x64 --no-restore --self-contained true /p:PublishSingleFile=true /p:SkipFrontendBuild=true -o artifacts/publish-check/win-x64
• dotnet publish listenarr.api/Listenarr.Api.csproj -c Release -r osx-x64 --no-restore --self-contained true /p:PublishSingleFile=true /p:SkipFrontendBuild=true -o artifacts/publish-check/osx-x64
• dotnet publish listenarr.api/Listenarr.Api.csproj -c Release -r linux-arm64 --no-restore --self-contained false /p:UseAppHost=false /p:SkipFrontendBuild=true -o artifacts/publish-check/linux-arm64
• npm install
• cd fe && npm install
• cd fe && npm run test:unit
  • 378 passed, 1 skipped test file
• cd fe && npm run build
• cd fe && npm run lint:check
• git diff --check

The first backend test rerun after publish checks failed because a local Listenarr.Api process was holding build DLLs open. I stopped that process and reran the test suite successfully.

Notes

The router instance service is a pragmatic bridge, not the long-term frontend architecture. I opened #678 to track the cleaner follow-up: avoid router access from the auth store entirely and keep redirects in the router guard/app shell.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 58979b96e6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[therobbiedavis]

Addressed the RID-specific locked restore finding in the latest push (12aae2ba):

• Added the API publish RIDs to Listenarr.Api.csproj.
• Regenerated listenarr.api/packages.lock.json so it includes net10.0/linux-x64, net10.0/linux-arm64, net10.0/win-x64, and net10.0/osx-x64.
• Updated the test/release publish steps to use the already-restored graph with --no-restore.
• Verified dotnet restore listenarr.slnx /p:CI=true, backend tests, and no-restore publish checks for the workflow RIDs.

[therobbiedavis]

Closing this in favor of the combined foundation PR: #686. The dependency restore/frontend build validation changes from this PR are included there.