Address review findings: bugs, memory leaks, CSS consolidation

[piratefinn]

This branch applies review findings from PR runbox#1849. Two commits cover 23 fixes across 8 files: a critical domain-selector bug, five memory leak and timer bugs, validation and UX improvements, test hardening, and CSS consolidation.

Context

The signup page is a solid piece of work: lazy-loaded standalone module, runtime API config, native form POST to the Perl backend, and an intentional marketing-surface visual identity separate from the in-app Material theme. Three review passes found 23 issues; 19 were fixed in the first commit (dcb2fe25), 4 more in the refinement commit (86538deb), and 7 items remain deferred.

Critical

Domain selector rendered [object Object] in production. getRunboxDomains() declared Observable<string[]> but the backend returns {id, name}[]. Tests passed because mocks matched the (incorrect) signature. Fixed by mapping objects to strings at the consumer and correcting all mocks. The service signature fix is deferred (touches every consumer).

Memory leaks and timer bugs

• setInterval leak on hCaptcha script error — polling never stopped after a failed script tag. Fixed with clearInterval in the error listener.
• Unbounded setTimeout(0) retry in renderHCaptcha — survived component destroy, leaked memory. Fixed with destroyed flag and timer capture/clear in ngOnDestroy.
• Async chain after destroy — subscriptions appended script to DOM after ngOnDestroy. Fixed with subs.add() teardown and post-await guard.
• Stale timer cross-instance interference — timeout from instance A could remove the script element instance B was polling. Fixed with destroyed guard in catch handler.
• Failed script stayed in DOM — caused polling leak on revisit. Fixed with .catch removal.

Validation and UX

• Submit guard used hCaptchaSiteKey (set early) instead of hCaptchaReady (set after load), giving a misleading error. Fixed guard and disambiguated message.
• formElement.submit() throwing left submitInProgress stuck. Fixed with try/catch and state reset.
• "Complete the CAPTCHA" message shown when widget failed to load (not the user's fault). Fixed by clearing site key on failure.
• Focus selector returned wrong element via querySelector alternation. Fixed with two-pass: Angular-invalid first, native-invalid second.
• ASCII-only password regex excluded Unicode users. Fixed with \p{Ll}/u, \p{Lu}/u.
• account_number forwarded without validation. Added /^[0-9]{0,12}$/ check before binding.
• getSignupHCaptchaSiteKey could return undefined. Added res?.result ?? ''.

Cleanup

• Dead SIGNUP_HCAPTCHA_SITE_KEY env var removed from gen-env.js.
• Dead accountType hidden form field removed (backend ignores it).
• 20 hardcoded hex literals replaced with SCSS palette tokens ($rmm-signup-slate-*, mat.get-color-from-palette($rmm-default-error)).
• Footer gradient hex literals replaced with palette tokens matching the header.
• Array.isArray guard added on domain list (folded into C1 fix).

CSS consolidation

The four-step breakpoint ladder (900/720/560/420px) repeated padding, width, and font-size overrides. Consolidated into fluid clamp() expressions on the base declarations — 35 lines net reduction (883 to 844 lines), no visual change at any viewport.

Change	Expression
Hero/note horizontal padding	clamp(0.9rem, calc(1.5vw + 0.45rem), 1.75rem)
Form horizontal padding	clamp(0.9rem, calc(1.2vw + 0.45rem), 1.5rem)
Width gutter	clamp(0.75rem, calc(2vw + 0.4rem), 2rem)
Hero text font-size	clamp(0.92rem, calc(0.4vw + 0.84rem), 1.04rem)
Body copy font-size	clamp(0.92rem, calc(0.4vw + 0.8rem), 1rem)

Tests

• Mock domain shape corrected to {id, name}[] with explanatory comment
• window.hcaptcha stub added in beforeEach, cleaned up in afterEach
• "captcha missing" split into script-failed (system fault) vs user-skipped (user fault)
• New "still loading" test with resolver pattern to prevent GC leak
• afterEach uses try/finally for defensive cleanup
• Cypress stub captures window.__hcaptchaParams (scaffolding for future callback tests)

254 pass, 0 fail, 2 skipped.

Backend verification

API contracts verified against RMM/perl/ source:

• GET /rest/v1/signup/hcaptcha/site_key returns {status, result: '<key>'} (scalar). Endpoint is unauthenticated, which is correct for signup.
• GET /rest/v1/runbox_domains returns {status, results: [{name, id}]} (array). Consumer maps objects to strings.
• POST /signup/signup reads 20 form fields. Backend does not read type, accountType, or domain — dead accountType field removed.
• Password validation: backend (Runbox::Core::Utils->check_password) is authoritative; client-side meter is advisory only.
• Honeypot: phone_number_home silently blocks signup if filled. Correctly included as hidden field.

Architecture notes

The signup page is a marketing surface with its own visual identity. The 13 new SCSS palette tokens in _rmm-theme-vars.scss are correctly scoped: they produce zero CSS output, are consumed only by signup.component.scss via @use, and do not leak into the global stylesheet. The component uses default Emulated view encapsulation, so all styles are scoped to the component host regardless of file size.

Deferred follow-ups

Item	Why
rbwebmail.ts return type fix	Touches every consumer (aliases, profiles, recipients, singlemailviewer)
Interceptor skip for signup endpoints	Touches shared auth code, needs allowlist tests
SRI on hCaptcha script	hCaptcha rotates hashes frequently, needs update cadence decision
Material primitive swap (I3 tier B)	Design call: signup intentionally differs from in-app Material look
CJK password scoring	Design decision on scoring system (3/4 vs 3/5 character classes)
Cypress callback tests	Stub is scaffolding-ready, tests not yet written
%signup-card SCSS placeholder	Requires extracting shared properties across unrelated selectors