The new user-file download responses set Content-Disposition,
X-Filename, and X-Display-Name from user-supplied filenames and
IGC pilot names. WHATWG Headers values must be ASCII, so an IGC
with a non-ASCII pilot ("François") would 500 the download.
Add asciiHeaderSafe() and an RFC 5987 filename*=UTF-8'' builder;
also cap x-filename at 255 chars.

Vite's dev proxy only forwarded /api/auth and /api/comp; the new
/api/user and /api/u/ routes 404'd under `bun run dev` because
the Pages Functions only run in production. Add proxy entries
so manual testing works end-to-end.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CI failed all upload tests except the first one — that test happened to
check #tracks-empty before setInputFiles, which incidentally synchronised
on dashboard.ts's first refreshLists() call. The other tests raced the
change-event listener attachment and the file selection was a no-op.

Hoist the wait into signInAndOnboard so every test sees a fully-mounted
dashboard before driving the upload inputs.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CI on 98c680c failed the pre-existing comp-creation test with a 60s
timeout waiting for the create-comp dialog to open after clicking the
button. comp.ts attaches the dialog-opening click handler only after
loadComps() resolves; the test was clicking the button before the
handler was bound, so the click was a no-op.

Wait for networkidle (initNav's /api/auth/me and loadComps' /api/comp
both completed) before sending the click.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The retry attempts on 59d2afd hit "Competition not found" — comp-detail.ts
called showNotFound() because /api/comp/:id raced one of the concurrent
/api/auth/me calls (initNav + preferences-sync bootstrap) and resolved
without a user, so the test-comp admin check returned 404.

Wait for networkidle after the redirect so all the page's startup
requests complete before we read #comp-title. If the GET is going to
succeed, it has by then; if it's going to fail, it's already failed,
so the assertion can read the populated title instead of the
intermediate empty state.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The next time GHA flakes a test we want a per-step waterfall (action +
network + console) to tell whether it's a real race in our code or just
slow infrastructure. retain-on-failure keeps the trace zip only when a
test fails, so passing runs stay cheap.

Traces land in test-results/ rather than playwright-report/, so the
upload-artifact step needed both paths. Open one locally with
`bunx playwright show-trace test-results/<dir>/trace.zip`.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…500s

Hono's default error response is a plain "Internal Server Error" body,
which left a real bug invisible: the CI comp-creation flake on this
branch is a 500 from GET /api/comp/:id that the frontend catches and
renders as "Competition not found". With no error body, the playwright
trace just shows status=500 — no clue what threw.

Add an app.onError that logs the stack server-side and returns
{ error: <message> } with status 500. Stack stays server-side; the
message is enough for the trace to point at the real failure.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

The comp-creation + user-files-upload specs share the local D1 instance,
and with Playwright's default 2 workers on GHA they race a 500 out of
GET /api/comp/:id roughly half the time. Forcing workers: 1 in CI keeps
the runs deterministic at the cost of a few seconds of wall time.
Local stays parallel (workers: undefined) so dev iteration is unaffected.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Same rationale as the competition-api change in dddc2c8: Hono's default
"Internal Server Error" body hides the real exception, so any 500 from
auth-api (e.g. Better Auth misconfiguration, D1 session race) shows up
in CI traces and wrangler tail as a stackless mystery. Logs the stack
server-side and returns { error: <message> } to the caller.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>