release: v0.16.0

See CHANGELOG.md for the full v0.16.0 entry.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: ralksta <ralksta@users.noreply.github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Ralf <rohlenbo79@gmail.com>
Co-authored-by: Paul Thies <110185070+ImScheinox@users.noreply.github.com>
Co-authored-by: lancetm714 <108419425+lancetm714@users.noreply.github.com>

app/admin/__tests__/AdminShell.test.tsx

@@ -0,0 +1,71 @@
+// @vitest-environment jsdom
+import { describe, it, expect, vi, afterEach } from 'vitest';
+import { render, screen, cleanup, waitFor, act } from '@testing-library/react';
+import AdminShell from '../AdminShell';
+import { SESSION_EXPIRED_EVENT } from '../components/sessionExpiry';
+
+vi.mock('next/navigation', () => ({
+  usePathname: () => '/admin',
+}));
+
+afterEach(cleanup);
+
+/**
+ * Sessions last 24 hours, but nothing re-checked authentication after the
+ * mount-time check below — leave a tab open overnight and every admin
+ * request answered 401 while the UI still looked signed in (#596).
+ * SESSION_EXPIRED_EVENT, raised by any admin fetch call site that notices a
+ * 401, is what this pins: it drops the whole panel back to the login screen
+ * with an explanation, instead of each call site failing quietly.
+ */
+describe('AdminShell session expiry', () => {
+  it('returns to the login screen with a notice when the session expires', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async (url: string) => {
+        if (url === '/api/admin/auth') {
+          return new Response(JSON.stringify({ authenticated: true, enabled: true }), {
+            status: 200,
+          });
+        }
+        // AdminDashboard's own status/doctor fetches — a failure there is
+        // already handled as "unknown", not the thing under test here.
+        return new Response(null, { status: 500 });
+      }),
+    );
+
+    render(
+      <AdminShell>
+        <div>Panel content</div>
+      </AdminShell>,
+    );
+
+    await waitFor(() => expect(screen.getByText('Panel content')).toBeTruthy());
+    expect(screen.queryByLabelText('Password')).toBeNull();
+
+    act(() => {
+      window.dispatchEvent(new CustomEvent(SESSION_EXPIRED_EVENT));
+    });
+
+    await waitFor(() =>
+      expect(screen.getByText('Your session expired. Sign in again.')).toBeTruthy(),
+    );
+    expect(screen.queryByText('Panel content')).toBeNull();
+  });
+
+  it('shows no notice on an ordinary first visit', async () => {
+    vi.stubGlobal(
+      'fetch',
+      vi.fn(async () => new Response(JSON.stringify({ authenticated: false, enabled: true }))),
+    );
+
+    render(
+      <AdminShell>
+        <div>Panel content</div>
+      </AdminShell>,
+    );
+
+    await waitFor(() => expect(screen.getByLabelText('Password')).toBeTruthy());
+    expect(screen.queryByText('Your session expired. Sign in again.')).toBeNull();
+  });
+});