chore(auth): remove the Apple review test account and its posting key

[Bielcx]

The app is approved and live on the App Store, which is the point AGENTS.md
said to delete this. It shipped a HIVE posting key for @skatethread in
plaintext, in a public repository, next to the short password that swapped
itself for the key at login.

The diff is purely subtractive: the three constants and the branch in login
go, nothing is added. The normal path already fell through to
validate_posting_key, so signing in is unchanged for every account.

The gotcha instructing us to remove this goes too, since it now describes
something that is not there.

This does not end the exposure

The key was public for the life of the repository and remains in git history.
It has to be rotated on chain. Deleting the source is only half of it.

If Apple asks for demo credentials on the next submission, they belong in the
App Store Connect notes field, not in the source.

The one behaviour change

Signing in as skatethread with the short password stops working. The real
posting key still works, like any other account.

Testing

npx tsc --noEmit clean. Diff reviewed against docs/pre-pr-checklist.md and
for security risk: the change removes a credential and adds no code path, so
there is no new surface to review.

Summary by CodeRabbit

• Bug Fixes

  • Removed the special Apple App Store review test-account login behavior.
  • Login now consistently validates the credentials entered by the user.

• Documentation

  • Updated troubleshooting guidance with HIVE RPC failover and video autoplay viewport behavior.
  • Clarified PostCard padding usage across screens.
  • Documented that the project does not currently include an automated test suite.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fa80afab-e484-407e-9fd6-6e57466a571a

📥 Commits

Reviewing files that changed from the base of the PR and between fadd7a5 and a11450c.

📒 Files selected for processing (2)

• AGENTS.md
• lib/auth-provider.tsx

💤 Files with no reviewable changes (1)

• lib/auth-provider.tsx

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Apple review test-account bypass was removed from authentication. The related warning was removed from AGENTS.md, and the remaining Common Gotchas entries were renumbered.

Changes

Apple review account removal

Layer / File(s)	Summary
Remove test-account authentication bypass lib/auth-provider.tsx	Removed the Apple review test-account constants and special-case posting-key substitution. The former credentials now use normal validate_posting_key validation.
Update Common Gotchas guidance AGENTS.md	Removed the Apple review test-account warning and renumbered the remaining entries. Existing guidance remains.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to a1145

The change removes the obsolete Apple review account credentials while preserving normal sign-in behavior. No actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: sktbrd

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary authentication change: removing the Apple review test account and its HIVE posting key.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/remove-apple-review-test-account

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Bielcx]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.