ML-194: add selective smoke coverage

Add smoke tests for bulk cron workers, CSP browser header, and
on_mount hooks (GetTimezone/StaticAssets). 9 tests across 4 files,
all passing alongside 135 existing related tests.

test/music_library/worker/bulk_cron_workers_test.exs

@@ -0,0 +1,72 @@
+defmodule MusicLibrary.Worker.BulkCronWorkersTest do
+  use MusicLibrary.DataCase
+
+  import MusicLibrary.Fixtures.Records
+
+  alias MusicLibrary.Worker.ArtistRefreshAllDiscogsData
+  alias MusicLibrary.Worker.ArtistRefreshAllMusicBrainzData
+  alias MusicLibrary.Worker.ArtistRefreshAllWikipediaData
+  alias MusicLibrary.Worker.RecordGenerateAllEmbeddings
+  alias MusicLibrary.Worker.RecordRefreshAllMusicBrainzData
+
+  describe "RecordRefreshAllMusicBrainzData" do
+    test "enqueues per-record MusicBrainz refresh jobs" do
+      rec = record()
+
+      assert {:ok, []} = perform_job(RecordRefreshAllMusicBrainzData, %{})
+
+      assert_enqueued worker: MusicLibrary.Worker.RecordRefreshMusicBrainzData,
+                      args: %{id: rec.id}
+    end
+  end
+
+  describe "RecordGenerateAllEmbeddings" do
+    test "enqueues per-record embedding generation jobs" do
+      rec = record()
+
+      assert {:ok, []} = perform_job(RecordGenerateAllEmbeddings, %{})
+
+      assert_enqueued worker: MusicLibrary.Worker.GenerateRecordEmbedding,
+                      args: %{record_id: rec.id}
+    end
+  end
+
+  describe "ArtistRefreshAllMusicBrainzData" do
+    test "enqueues per-artist MusicBrainz refresh jobs" do
+      rec = record()
+      artist = hd(rec.artists)
+      info = artist_info(artist.musicbrainz_id)
+
+      assert {:ok, []} = perform_job(ArtistRefreshAllMusicBrainzData, %{})
+
+      assert_enqueued worker: MusicLibrary.Worker.ArtistRefreshMusicBrainzData,
+                      args: %{id: info.id}
+    end
+  end
+
+  describe "ArtistRefreshAllDiscogsData" do
+    test "enqueues per-artist Discogs refresh jobs" do
+      rec = record()
+      artist = hd(rec.artists)
+      info = artist_info(artist.musicbrainz_id)
+
+      assert {:ok, []} = perform_job(ArtistRefreshAllDiscogsData, %{})
+
+      assert_enqueued worker: MusicLibrary.Worker.ArtistRefreshDiscogsData,
+                      args: %{id: info.id}
+    end
+  end
+
+  describe "ArtistRefreshAllWikipediaData" do
+    test "enqueues per-artist Wikipedia refresh jobs" do
+      rec = record()
+      artist = hd(rec.artists)
+      info = artist_info(artist.musicbrainz_id)
+
+      assert {:ok, []} = perform_job(ArtistRefreshAllWikipediaData, %{})
+
+      assert_enqueued worker: MusicLibrary.Worker.ArtistRefreshWikipediaData,
+                      args: %{id: info.id}
+    end
+  end
+end

test/music_library_web/browser_pipeline_test.exs

@@ -0,0 +1,34 @@
+defmodule MusicLibraryWeb.BrowserPipelineTest do
+  use MusicLibraryWeb.ConnCase
+
+  describe "Content-Security-Policy header" do
+    @describetag :logged_out
+
+    test "includes project-specific directives on HTML responses", %{conn: conn} do
+      conn = get(conn, ~p"/health")
+
+      assert [csp] = get_resp_header(conn, "content-security-policy")
+
+      # Baseline
+      assert csp =~ "default-src 'self'"
+
+      # App-specific image origins (cover art, Brave search)
+      assert csp =~ "img-src 'self' data: blob:"
+      assert csp =~ "https://lastfm.freetls.fastly.net"
+      assert csp =~ "https://imgs.search.brave.com"
+      assert csp =~ "https://coverartarchive.org"
+
+      # Worker support (barcode-detector WASM)
+      assert csp =~ "worker-src 'self' blob:"
+
+      # Connect for CDN (barcode-detector JS)
+      assert csp =~ "connect-src 'self' https://fastly.jsdelivr.net"
+
+      # No framing from other origins
+      assert csp =~ "frame-ancestors 'self'"
+
+      # Base URI locked to same origin
+      assert csp =~ "base-uri 'self'"
+    end
+  end
+end

test/music_library_web/hooks/get_timezone_test.exs

@@ -0,0 +1,25 @@
+defmodule MusicLibraryWeb.Hooks.GetTimezoneTest do
+  use MusicLibraryWeb.ConnCase
+
+  import Phoenix.LiveViewTest, only: [live: 2, put_connect_params: 2]
+
+  describe "on_mount/4" do
+    test "falls back to default_timezone when no connect param is provided", %{conn: conn} do
+      {:ok, view, _html} = live(conn, ~p"/collection")
+      socket = :sys.get_state(view.pid).socket
+
+      assert socket.assigns.timezone == MusicLibrary.default_timezone()
+    end
+
+    test "assigns timezone from connect params when provided", %{conn: conn} do
+      {:ok, view, _html} =
+        conn
+        |> put_connect_params(%{"timezone" => "America/New_York"})
+        |> live(~p"/collection")
+
+      socket = :sys.get_state(view.pid).socket
+
+      assert socket.assigns.timezone == "America/New_York"
+    end
+  end
+end

test/music_library_web/hooks/static_assets_test.exs

@@ -0,0 +1,14 @@
+defmodule MusicLibraryWeb.Hooks.StaticAssetsTest do
+  use MusicLibraryWeb.ConnCase
+
+  import Phoenix.LiveViewTest, only: [live: 2]
+
+  describe "on_mount/4" do
+    test "assigns :static_changed to a boolean", %{conn: conn} do
+      {:ok, view, _html} = live(conn, ~p"/collection")
+      socket = :sys.get_state(view.pid).socket
+
+      assert is_boolean(socket.assigns.static_changed)
+    end
+  end
+end