feat: sync CLI with dashboard@v1.6.16

[cursor]

Upstream version

• dashboard@v1.6.16 (cdcd44b2a4012d819ed3e9a83c54973fa9f83b8d)
• @photon-ai/dashboard-api 1.6.12 → 1.6.16

Routes added/removed/changed

Spans dashboard releases v1.6.13 → v1.6.16. See UPSTREAM_DIFF.md.

• Added: POST /api/otp/phone2/send — real phone-OTP send path introduced in dashboard#259 (v1.6.15). The legacy POST /api/otp/phone/send route is preserved as a decoy honeypot. CLI never calls api.otp.*, so no command change is needed.
• Removed: none.
• Changed:
  • GET /api/projects/:id — response gained avatarUrl: string | null, plan: PlanTier, platforms: SpectrumPlatformId[], userCount: number (dashboard#255, v1.6.14). Surfaced plan, platforms, and userCount in photon projects show. avatarUrl is skipped — CLI can't render images and it's redundant with the spectrum avatar commands.
  • POST /api/otp/phone/send — cosmetic code/captchaToken body-field reordering (v1.6.15). No behavior change; CLI does not call this route.
• v1.6.13 (dashboard#250, >3-dots signup suspension) and v1.6.16 (dashboard#260, log real phone sends after three OTP failures) are pure server-side changes with bit-identical @photon-ai/dashboard-api dist output.

Snapshot changes

• (none)

New runtime dependencies

• (none) — only the existing @photon-ai/dashboard-api devDependency was bumped.

Checklist

• API type changes come from a @photon-ai/dashboard-api version bump, not hand edits
• No new runtime deps
• All snapshot diffs explained above
• bun run check passes locally

  

---

^{Need help on this PR? Tag /codesmith with what you need. Autofix is disabled.}

---

Note

Low Risk
Low-risk dependency bump plus read-only display fields on an existing show command; no auth, billing, or OTP behavior changes in the CLI.

Overview
Syncs the CLI with dashboard @photon-ai/dashboard-api 1.6.12 → 1.6.16 and refreshes UPSTREAM_DIFF.md for the v1.6.13–v1.6.16 route delta (notably POST api.otp.phone2.send and richer GET api.projects.:id responses).

photon projects show now prints plan, platforms, and userCount from the updated project detail payload; avatarUrl is intentionally omitted from the terminal view.

No new runtime dependencies and no CLI commands added for OTP routes—the CLI does not call api.otp.*.

^{Reviewed by Cursor Bugbot for commit 730ecea. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Agent PR Review

Scenario: A — Initial review (PR opened by cursor[bot])
Verdict: ✅ Approve

What's right

• @photon-ai/dashboard-api bumped 1.6.12 → 1.6.16 cleanly in both package.json and bun.lock; no hand-edited API types.
• New plan / platforms / userCount fields from the changed GET /api/projects/:id shape are surfaced in photon projects show via the existing printKv block, matching neighboring key style.
• The avatarUrl skip is defensible and explained in the PR body (CLI can't render images; spectrum avatar commands own that flow).
• New POST /api/otp/phone2/send route is correctly deferred — CLI never calls api.otp.*, so no command surface is needed.
• No forbidden deps, no raw fetch() bypass, no changes to .github/workflows/ or scripts/agent-flow/, no snapshot churn, no unrelated refactors.
• bun install --frozen-lockfile && bun run check runs green locally (typecheck + 90 tests + build).

Concerns

• None blocking.

Deferred (acknowledged in PR body)

• POST /api/otp/phone2/send — new route, no CLI consumer.
• avatarUrl on GET /api/projects/:id — intentionally skipped for TTY rendering reasons.
• v1.6.13 and v1.6.16 dashboard changes — server-only, bit-identical dist output.

Final note

Clean, minimal upstream-sync PR. Marked ready for review and labeled agent-review:approved + agent-flow.