ML-194: add selective smoke coverage

Add smoke tests for bulk cron workers, CSP browser header, and
on_mount hooks (GetTimezone/StaticAssets). 9 tests across 4 files,
all passing alongside 135 existing related tests.

test/music_library_web/browser_pipeline_test.exs

@@ -0,0 +1,34 @@
+defmodule MusicLibraryWeb.BrowserPipelineTest do
+  use MusicLibraryWeb.ConnCase
+
+  describe "Content-Security-Policy header" do
+    @describetag :logged_out
+
+    test "includes project-specific directives on HTML responses", %{conn: conn} do
+      conn = get(conn, ~p"/health")
+
+      assert [csp] = get_resp_header(conn, "content-security-policy")
+
+      # Baseline
+      assert csp =~ "default-src 'self'"
+
+      # App-specific image origins (cover art, Brave search)
+      assert csp =~ "img-src 'self' data: blob:"
+      assert csp =~ "https://lastfm.freetls.fastly.net"
+      assert csp =~ "https://imgs.search.brave.com"
+      assert csp =~ "https://coverartarchive.org"
+
+      # Worker support (barcode-detector WASM)
+      assert csp =~ "worker-src 'self' blob:"
+
+      # Connect for CDN (barcode-detector JS)
+      assert csp =~ "connect-src 'self' https://fastly.jsdelivr.net"
+
+      # No framing from other origins
+      assert csp =~ "frame-ancestors 'self'"
+
+      # Base URI locked to same origin
+      assert csp =~ "base-uri 'self'"
+    end
+  end
+end

test/music_library_web/hooks/get_timezone_test.exs

@@ -0,0 +1,25 @@
+defmodule MusicLibraryWeb.Hooks.GetTimezoneTest do
+  use MusicLibraryWeb.ConnCase
+
+  import Phoenix.LiveViewTest, only: [live: 2, put_connect_params: 2]
+
+  describe "on_mount/4" do
+    test "falls back to default_timezone when no connect param is provided", %{conn: conn} do
+      {:ok, view, _html} = live(conn, ~p"/collection")
+      socket = :sys.get_state(view.pid).socket
+
+      assert socket.assigns.timezone == MusicLibrary.default_timezone()
+    end
+
+    test "assigns timezone from connect params when provided", %{conn: conn} do
+      {:ok, view, _html} =
+        conn
+        |> put_connect_params(%{"timezone" => "America/New_York"})
+        |> live(~p"/collection")
+
+      socket = :sys.get_state(view.pid).socket
+
+      assert socket.assigns.timezone == "America/New_York"
+    end
+  end
+end

test/music_library_web/hooks/static_assets_test.exs

@@ -0,0 +1,14 @@
+defmodule MusicLibraryWeb.Hooks.StaticAssetsTest do
+  use MusicLibraryWeb.ConnCase
+
+  import Phoenix.LiveViewTest, only: [live: 2]
+
+  describe "on_mount/4" do
+    test "assigns :static_changed to a boolean", %{conn: conn} do
+      {:ok, view, _html} = live(conn, ~p"/collection")
+      socket = :sys.get_state(view.pid).socket
+
+      assert is_boolean(socket.assigns.static_changed)
+    end
+  end
+end