fix(test): type the fetch spy so tsc strict-tuple check passes

Vitest's vi.fn() with no signature returns Mock<[], unknown>; reading
mock.calls[0][0] / [0][1] under TS strict (noUncheckedIndexedAccess +
strict tuple types) raises TS2493. Give the spy a typed signature
matching `fetch(input, init?)` so the destructuring works without
casts.

`npm run gate` clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mastermanas805

src/pages/LoginCallbackPage.test.tsx

@@ -88,21 +88,24 @@ describe('LoginCallbackPage', () => {
   // ---- AUTH-004 (cookie-exchange) flow ----
 
   it('AUTH-004: ?signed_in=1 → POSTs /auth/exchange with credentials:include + uses returned token', async () => {
-    const fetchSpy = vi.fn(() => Promise.resolve(new Response(JSON.stringify({ token: 'xyz' }), {
-      status: 200,
-      headers: { 'Content-Type': 'application/json' },
-    })))
+    const fetchSpy = vi.fn(
+      (_input: RequestInfo | URL, _init?: RequestInit) =>
+        Promise.resolve(new Response(JSON.stringify({ token: 'xyz' }), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        })),
+    )
     ;(globalThis as any).fetch = fetchSpy
     ;(api.fetchMe as any).mockResolvedValue({ ok: true })
 
     renderCallback('?signed_in=1')
     await waitFor(() => expect(screen.getByTestId('app-landed')).toBeTruthy())
 
     expect(fetchSpy).toHaveBeenCalledTimes(1)
-    const call = fetchSpy.mock.calls[0]
-    expect(String(call[0])).toMatch(/\/auth\/exchange$/)
-    expect((call[1] as RequestInit).method).toBe('POST')
-    expect((call[1] as RequestInit).credentials).toBe('include')
+    const [url, init] = fetchSpy.mock.calls[0] as [RequestInfo | URL, RequestInit]
+    expect(String(url)).toMatch(/\/auth\/exchange$/)
+    expect(init.method).toBe('POST')
+    expect(init.credentials).toBe('include')
     expect(api.setToken).toHaveBeenCalledWith('xyz')
   })
 
@@ -143,7 +146,9 @@ describe('LoginCallbackPage', () => {
 
   it('AUTH-004: signed_in=1 + legacy session_token both present → legacy wins (idempotent fallback)', async () => {
     ;(api.fetchMe as any).mockResolvedValue({ ok: true })
-    const fetchSpy = vi.fn()
+    const fetchSpy = vi.fn((_input: RequestInfo | URL, _init?: RequestInit) =>
+      Promise.resolve(new Response('{}', { status: 200 })),
+    )
     ;(globalThis as any).fetch = fetchSpy
 
     renderCallback('?signed_in=1&session_token=legacy123')