fix(web-shell): proxy the PR watches route in dev (#16004)

* fix(web-shell): proxy the PR watches route in dev

The dev server's proxy table had no entry for the autofix-pr routes, so
`GET /autofix-pr/watches` fell through to the SPA fallback and answered
with index.html. The PR watches page then failed JSON parsing on open
and reported "Unexpected token '<'". Only the primary workspace's
unqualified route was affected: the workspace-qualified form is already
reached by the `/workspace` prefix entry.

Production is unaffected because the daemon serves the page and the API
from the same origin, with no dev proxy in between. The browser suites
did not catch it because they stub the route at the network layer, which
intercepts the request before it reaches the dev server.

* test(web-shell): fold the PR watches proxy case into the coverage table

Review feedback on #16004: the standalone block repeated the existing
daemon-API coverage table's lookup, request shape and bypass assertion,
and pinned the entry to the Goals route by reference identity. That pin
was arbitrary — nothing requires the two routes to share one object — so
re-objecting Goals with the spread idiom this file already uses elsewhere
would have reddened the PR-watches case while the route itself stayed
correct, pointing a future reader at the wrong entry.

The case is now a row in the existing table, which keeps one enumerated
list of the primary prefixes the dev proxy must serve. Each row carries
the URL the daemon actually serves rather than a derived one. The
load-bearing assertions are unchanged: deleting the proxy entry still
reds exactly this row, and re-objecting Goals no longer affects it.

packages/web-shell/client/vite-config.test.ts

@@ -223,14 +223,21 @@ describe('Web Shell client source proxy bypass', () => {
 });
 
 describe('Web Shell daemon API proxy coverage', () => {
-  it.each(['/standalone', '/live'])('proxies %s API routes', (prefix) => {
+  // Without its own entry the SPA fallback answers these with index.html in
+  // dev and the page fails JSON parsing on open.
+  it.each([
+    { prefix: '/standalone', url: '/standalone/status' },
+    { prefix: '/live', url: '/live/status' },
+    // The only unqualified route in this namespace is the watches listing.
+    { prefix: '/autofix-pr', url: '/autofix-pr/watches' },
+  ])('proxies $prefix API routes', ({ prefix, url }) => {
     const proxy = loadConfig().server?.proxy?.[prefix];
     expect(proxy).not.toBeTypeOf('string');
     expect(proxy).toBeDefined();
     const options = proxy as ProxyOptions;
     const request = {
       method: 'GET',
-      url: `${prefix}/status`,
+      url,
       headers: { accept: '*/*' },
     } as unknown as IncomingMessage;
 

packages/web-shell/vite.config.ts

@@ -262,6 +262,10 @@ export default defineConfig(({ command }) => ({
       // Goals page (`GET /goals`). Without it the SPA fallback returns
       // index.html in dev and the page fails JSON parsing on open.
       '/goals': daemonProxy,
+      // PR watches page (`GET /autofix-pr/watches`). Same reason as the routes
+      // above. The workspace-qualified form is already reached by the
+      // `/workspace` prefix; only the primary's unqualified route needs this.
+      '/autofix-pr': daemonProxy,
       // Token-usage dashboard (Daemon Status "统计" tab). Same reason as the
       // routes above — without it the SPA fallback returns index.html in dev and
       // the tab fails JSON parsing on `GET /usage/dashboard`.