feat: sync CLI with dashboard@v1.6.14

[cursor]

Upstream version

@photon-ai/dashboard-api@1.6.14 (dashboard v1.6.14, sha bf18b4a3b72c4ddb03ebee09b0c176959daa847b)

Routes added/removed/changed

• Changed GET /api/projects/:id — response gained four additive fields (dashboard#255):
  • avatarUrl: string | null
  • plan: PlanTier ("free" | "pro" | "business" | "enterprise")
  • platforms: SpectrumPlatformId[]
  • userCount: number
• Added: (none)
• Removed: (none)

photon projects show now surfaces plan, platforms, and userCount in the details block — the whole point of dashboard#255. avatarUrl is left out since the CLI doesn't render images.

The rest of v1.6.14 is server-side hardening (dashboard#251 phone-OTP suspension, #256 suspended-user redirect, #257 email-domain OTP abuse controls) or dashboard-UI-only (#253 --yes scaffold flag) and doesn't touch the public API surface.

Snapshot changes

• (none)

New runtime dependencies

• (none)

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps (or justified above)
• All snapshot diffs explained above
• bun run check passes locally

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

[cursor]

Bugbot is paused — on-demand spend limit reached

Bugbot uses usage-based billing for this team and has hit its on-demand spend limit.

A team admin can raise the spend limit in the Cursor dashboard, or wait for the next billing cycle to continue.

[github-actions]

Agent PR Review

Scenario: A — Initial review (PR opened by cursor[bot])
Verdict: ✅ Approve

What's right

• Single, contained change: package.json + bun.lock bump @photon-ai/dashboard-api 1.6.12 → 1.6.14, UPSTREAM_DIFF.md refreshed, and src/commands/projects.ts surfaces the three new user-visible fields.
• Only additive DTO change (plan, platforms, userCount, avatarUrl on GET /api/projects/:id) is picked up via the version bump — no hand-edited types; src/lib/types.ts remains the empty passthrough it should be.
• Show command wiring at src/commands/projects.ts:137-139 matches the existing printKv style: plan printed as-is, platforms uses the same length > 0 ? join : c.dim("—") pattern already used in the list command, userCount coerced to string.
• avatarUrl intentionally omitted with justification in PR body (CLI doesn't render images) — appropriate for a text-only surface.
• getApi() + Eden treaty + { data, error, status } destructure preserved; 401 still routes through SessionExpiredError; no raw fetch(), no new deps, no forbidden deps, .github/workflows/ untouched, no snapshot churn.
• bun run check green locally (typecheck, 90 tests, build 246 KB).

Concerns

None blocking.

Deferred (acknowledged in PR body)

• avatarUrl — deliberately not surfaced (image field, CLI is text-only).
• Non-API dashboard changes (dashboard#251/#253/#256/#257) — server-side/UI-only, no CLI surface impact.

Final note

Version delta from main is technically 1.6.12 → 1.6.14 (1.6.13 was a server-side no-op for the public API — its dist diff against 1.6.12 was empty per the 1.6.13 bump commit), so the "1.6.13 → 1.6.14" framing in UPSTREAM_DIFF.md still fully covers the CLI-affecting delta. Marking Ready and approving.