test(gui): isolate dashboard suite so GitHub CI gets past GUI tests

[pavelhov]

What failed

GitHub ci died at cd gui && bun test tests on development and main (latest main run: 819 pass / 43 fail / 862 tests). Typecheck, privacy scan, and GUI lint were green, so the proxy Test suite step never started.

Reproduced from the failing GHA log (not old line numbers). The failures were not random assertions: search/type/click paths did not update React state (provider-catalog-search still showed the unfiltered Accounts list after typing; combo save never fired; notes blur never called onUpdateProvider; #cwi-edit-save stayed disabled). Two tests also burned ~10–15s dumping huge happy-dom objects after the assertion missed.

Locally on this branch, the same shared-global command was green (862 pass, ~42s). That is the GHA-only pattern already documented in rail-hover-delete-dom.test.tsx: a late React 19 dispatchSetState after afterEach restores window to undefined, resolveUpdatePriority reads window.event, and the throw poisons later files in the same process. Slower GHA makes the leak visible; a fast laptop often does not.

A second, in-file race: apikeys-mutation-timeout aborted the hanging mutation on a real 30ms setTimeout while the test flushed happy-dom timers. On a slow runner the abort already fired before expect(backButton().disabled).toBe(true).

Why

• Bun’s default bun test tests loads every GUI file in one shared global. Happy-dom tests replace globalThis.document / window.
• React 19 requires window.event. happy-dom omits it; a late tick after teardown throws.
• --parallel implies --isolate (fresh global per file). That is the same isolation idea as the proxy suite, without a full-rerun hack.

What changed

• gui/scripts/test.ts + gui bun run test: --parallel capped at min(4, CPU), junit used only to name failed files, retry those files once on one worker. Never reruns the whole suite.
• gui/tests/preload.ts + gui/bunfig.toml: stub Window.prototype.event and leave a tiny window after each file so a stray React tick cannot throw.
• apikeys-mutation-timeout: the test fires the mocked AbortSignal.timeout instead of racing 30ms of wall clock.
• add-codex-account-oauth: drive poll ticks through a mocked setInterval instead of waiting 7s.
• CI (ci.yml and the post-merge cross-platform GUI step): cd gui && bun run test. Permissions remain contents: read.

Out of scope: macOS packaging, privacy-scan internals, request-decompress, Cursor OAuth, proxy-suite runner.

Verification

Command	Result
GHA before (cd gui && bun test tests)	43 fail, ~70s, proxy suite skipped
cd gui && bun test tests --parallel=4	862 pass, 12.7s
cd gui && bun test tests --isolate	862 pass, 50s
cd gui && bun run test (CI command)	866 pass, 0 fail, 17.9s
bun run typecheck	pass
cd gui && bun run lint	pass
bun run privacy:scan	pass

GitHub ci on this PR is the remaining gate: it must get past GUI tests so the proxy suite actually runs.

Do not merge to main. Target is development.