[devjayy43]

Summary

Minimal fixes for three of the four issues from the frontend/docs audit.

• frontend/tests/e2e/csp-security.spec.ts: confirm Content-Security-Policy covers frontend/app/playground (likely iframe/eval-heavy) #1874 (CSP for /playground): csp-security.spec.ts only asserted a CSP it injected through page.route, so it never checked the header Next.js serves. Added a test that loads /playground without interception and asserts the served script-src is exactly 'self'. The playground does not use WASM or eval, so no per-route override is needed. Also fixed a duplicated const logs declaration in the same spec, which stopped the file from loading, and moved the console listener before navigation so load-time violations are captured.
• frontend/app/components: confirm shared components have Storybook stories given frontend/chromatic.config.json exists #1875 (Storybook coverage): Added stories for five shared components that had none: Skeleton, RiskBadge, CallGraphSkeleton, AnalysisTerminal, TrendChart. Not every shared component is covered yet (see below).
• frontend/app/api/v1: confirm versioned API has a deprecation/migration doc for future v2 #1881 (API versioning): Added docs/api-versioning.md with a v1 deprecation policy (Deprecation/Sunset headers, migration doc, notice period). The 6-month notice period and header requirements are a proposed policy for maintainers to confirm.

Not included: #1882 (providers). The providers have no async initialization that fails silently. There is no auth provider, and DashboardProvider has no promise chain. The only unguarded storage access is synchronous localStorage reads in ThemeProvider and WorkspaceProvider, which throw rather than fail silently. No change made, so this PR does not close #1882.

Remaining gaps

• Storybook stories still missing for shared components: Breadcrumbs (depends on next/navigation), DashboardHeader, KeyboardShortcuts, ComparisonView, TrendPanel, and Dashboard.
• csp-security.spec.ts still has a pre-existing @ts-ignore and an unused @ts-expect-error, both in the first test. Not touched here.

Verification

• npx playwright test tests/e2e/csp-security.spec.ts: 2 passed (dev server, Chromium).
• npx storybook build: succeeds with the new stories.
• npx tsc --noEmit: 13 errors, all pre-existing; none in the changed files.
• npx eslint on the changed files: only the pre-existing @ts-ignore finding.

Closes #1874
Closes #1875
Closes #1881
Closes #1882

[vercel]

@devjayy43 is attempting to deploy a commit to the gbangbolaoluwagbemiga's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@devjayy43 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits