feat(web): add authenticated Review BFF

[seonghobae]

Advances #209 as a dependency-ordered child of #225. This bounded slice adds first-party authenticated Weekly Review completion and immutable Review-history browser boundaries. The web BFF terminates browser credentials at Identity, derives workspace authority server-side, signs the exact Review method/path using the existing life-os.review-context.v1 contract, forwards no browser credential to Review, validates tenant and immutable completion evidence before projection, and omits workspace authority, idempotency keys, and payload digests from browser-visible responses.

Test-first RED is 24e5327657d33962cad77af9f3ce3699850538ea, which wires review-client.test.ts into the web test command before the production review-client.ts exists. Implementation is 365a4ee6500117c7bd618871e7b210bf52160eb3 and adds Next.js GET/POST route adapters plus route-contract coverage.

The slice accepts only Monday-anchored weekly-review completion commands, bounded canonical counts/timestamps/reflection, opaque UUIDv4 idempotency identity, and a bounded 1..100 history limit. It reconstructs only bounded browser-safe 400/401/409/503 problems and never forwards upstream problem bodies.

Keep Draft until parent #225 integrates/restacks through normal ancestry and the unchanged exact head satisfies focused/full repository CI, central required security/review workflows, review-thread resolution, and live-base compatibility. This slice adds no Review workspace UI and does not close #209.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}