fix: bound App token mint with a timeout; per-test axios mock lifecycle

Review feedback: appApi now carries an explicit 10s axios timeout so a
hanging GitHub API call degrades to the PAT slots within the request
instead of riding the invocation to the platform kill. The handle-card
App-slot tests recreate the MockAdapter per test — restore() detaches
the adapter, so a suite-level instance left later tests unmocked.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: vn7n24fzkq

api/utils/github-app-token.ts

@@ -17,6 +17,10 @@ import axios from 'axios';
 // per hour. They are never logged and never written to Redis.
 
 const REFRESH_MARGIN_MS = 5 * 60 * 1000; // re-mint when under 5 minutes left
+// A hanging mint would otherwise ride the whole function invocation while the
+// rotation can't move on — bound it so a slow GitHub API degrades to the PAT
+// slots within a request, not at the platform timeout.
+const MINT_TIMEOUT_MS = 10 * 1000;
 
 const cachedTokens = new Map<number, {token: string; expiresAtMs: number}>();
 const inflightMints = new Map<number, Promise<string>>();
@@ -76,7 +80,8 @@ async function appApi(method: 'get' | 'post', path: string, jwt: string): Promis
             'User-Agent': 'github-profile-summary-cards',
             Authorization: `Bearer ${jwt}`,
             Accept: 'application/vnd.github+json'
-        }
+        },
+        timeout: MINT_TIMEOUT_MS
     });
 }
 

tests/utils/handle-card.test.ts

@@ -143,7 +143,9 @@ describe('handleCard token rotation', () => {
 // The App slot participates in the same rotation: a working App serves cards,
 // a broken App (mint failure) rotates to the PATs instead of failing the card.
 describe('handleCard with a GitHub App slot', () => {
-    const mock = new MockAdapter(axios);
+    // Created per test: restore() detaches the adapter from axios, so a
+    // suite-level instance would leave later tests running unmocked.
+    let mock: InstanceType<typeof MockAdapter>;
     const originalEnv = {...process.env};
 
     // Pool: [GITHUB_APP, GITHUB_TOKEN, GITHUB_TOKEN_1]. Pick a username whose
@@ -154,7 +156,7 @@ describe('handleCard with a GitHub App slot', () => {
 
     beforeEach(() => {
         jest.clearAllMocks();
-        mock.reset();
+        mock = new MockAdapter(axios);
         __resetGitHubAppTokenCacheForTests();
         process.env.GITHUB_TOKEN = 'tok0';
         process.env.GITHUB_TOKEN_1 = 'tok1';