Auth instructions: real anchor links + clearer legacy lead-in (APP-3)

[rsteckler]

What

Follow-up to #35, addressing two pieces of feedback on the setup-wizard manual-paste instructions (web/src/routes/setup/AuthStep.tsx):

1. Real links, not just text. web.plaud.ai and api.plaud.ai/auth/refresh-user-token are now actual <a href> anchors (open in a new tab, styled as links). The api.plaud.ai in the "open your browser cookies for…" step is left as text since it's a cookie-domain descriptor, not a navigation target.
2. Clearer legacy lead-in. The tokenstr block now opens with "Don't see those cookies? You may be on Plaud's legacy platform." instead of "Still have the old tokenstr value?".

Verification

• pnpm -C web typecheck ✅
• pnpm -C web build ✅
• pnpm test ✅ (169 tests)

[github-actions]

Code Review: PR #36 — Auth instructions: real anchor links + clearer legacy lead-in (APP-3)

Reviewed at commit 56b475324a64348f8c12e3fcbcd455eb40a56474.

Overview

This is a small, focused follow-up to #35 that addresses two pieces of prior review feedback on the setup wizard's manual-paste auth instructions (web/src/routes/setup/AuthStep.tsx): (1) turning the plain-text web.plaud.ai and api.plaud.ai/auth/refresh-user-token references into real, clickable <a> anchors that open in a new tab, and (2) rewording the legacy-token lead-in to more clearly explain when a user should fall back to pasting the old tokenstr value. No logic, state, or API surface changes — pure copy/markup.

Strengths

• target="_blank" is correctly paired with rel="noopener noreferrer" on both new anchors, matching the existing pattern used in AppShell.tsx — no reverse-tabnabbing risk introduced.
• The PR body explicitly explains why api.plaud.ai in the cookie-domain sentence was deliberately left as <code> rather than turned into a link (it's a descriptor, not a navigation target) — good judgment call, and it's called out rather than left for the reviewer to wonder about.
• The new legacy lead-in ("Don't see those cookies? You may be on Plaud's legacy platform.") is more actionable than the old "Still have the old tokenstr value?" — it tells the user why they'd be here instead of assuming they already know they're on legacy.
• Diff is minimal and scoped exactly to the two review comments it claims to address — no drive-by changes.

Issues

No issues found. This is a copy/markup-only change with no behavioral, security, or architectural surface.

🟢 Anchor text duplicates href host (AuthStep.tsx:142-143) — minor / nit
Both links use the bare hostname/path as link text (web.plaud.ai, api.plaud.ai/auth/refresh-user-token), which is fine for a technical audience but means screen readers announce the raw domain twice in a row when both list items are read consecutively. Not worth blocking on — the existing style (plain <code>-wrapped host names) already set this precedent in #35.

Test coverage

No tests exist for AuthStep.tsx (or the rest of the setup wizard) before or after this PR — consistent with the rest of the directory, so this isn't a regression introduced by this change. The change itself is copy/markup only (no new conditional logic, state transitions, or API calls), so the risk of an untested regression is low. If the team ever adds coverage for this component, a simple render assertion that the two anchors have correct href/target/rel attributes would be cheap and would catch a future accidental regression (e.g. someone stripping rel during a refactor).

Security

No issues. rel="noopener noreferrer" is present on both new external links, preventing the linked page from accessing window.opener. Hrefs are hardcoded string literals (not derived from user input or props), so there's no injection vector.

Verdict

ship-as-is

Minimal, well-scoped diff that correctly addresses the two review comments from #35 with no new risk introduced.