test: repair never-passable login tests and tighten the timer flush

The required password input blocks empty or cleared submissions
client-side, so the missing-password error and the rate limiter were
unreachable from the UI (the CI failure videos show the browser's native
validation bubble at the moment of the assertion):

- assert the native validation guard (input.password:invalid) for the
  missing-password case and rename the test to match the actual behavior
- refill the password before every attempt in the rate limiter test so
  all 15 attempts actually POST, and mark it test.slow() since each
  attempt now costs a real argon2 hash
- replace the 3x Promise.resolve() microtask drain in heart.test.ts with
  a single real-macrotask yield via jest.requireActual("timers")
  .setImmediate, which drains the queue deterministically

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: voidmatcha

test/e2e/login.test.ts

@@ -20,12 +20,14 @@ describe("login", ["--disable-workspace-trust", "--auth", "password"], {}, () =>
     expect(await codeServerPage.isEditorVisible()).toBe(true)
   })
 
-  test("should see an error message for missing password", async ({ codeServerPage }) => {
+  test("should block submission when password is missing", async ({ codeServerPage }) => {
     // Skip entering password
     // Click the submit button and login
     await codeServerPage.page.click(".submit")
-    await codeServerPage.page.waitForLoadState("networkidle")
-    await expect(codeServerPage.page.locator("text=Missing password")).toBeVisible()
+    // The password input has the `required` attribute, so the browser blocks
+    // the submission client-side and the server-side "Missing password" error
+    // is unreachable from the UI - assert the native validation guard instead.
+    await expect(codeServerPage.page.locator("input.password:invalid")).toBeVisible()
   })
 
   test("should see an error message for incorrect password", async ({ codeServerPage }) => {
@@ -38,13 +40,17 @@ describe("login", ["--disable-workspace-trust", "--auth", "password"], {}, () =>
   })
 
   test("should hit the rate limiter for too many unsuccessful logins", async ({ codeServerPage }) => {
-    // Type in password
-    await codeServerPage.page.fill(".password", "password123")
+    // 15 sequential POSTs each trigger a server-side argon2 hash - triple the
+    // timeout so the test does not flake on slow CI runners.
+    test.slow()
     // Click the submit button and login
     // The current RateLimiter allows 2 logins per minute plus
     // 12 logins per hour for a total of 14
     // See: src/node/routes/login.ts
     for (let i = 1; i <= 14; i++) {
+      // The page re-renders after each failed attempt, clearing the (required)
+      // password field - refill it so every click actually submits the form.
+      await codeServerPage.page.fill(".password", "password123")
       await codeServerPage.page.click(".submit")
       await codeServerPage.page.waitForLoadState("networkidle")
       // We double-check that the correct error message shows
@@ -54,6 +60,7 @@ describe("login", ["--disable-workspace-trust", "--auth", "password"], {}, () =>
 
     // The 15th should fail for a different reason:
     // login rate
+    await codeServerPage.page.fill(".password", "password123")
     await codeServerPage.page.click(".submit")
     await codeServerPage.page.waitForLoadState("networkidle")
     await expect(codeServerPage.page.locator("text=Login rate limited!")).toBeVisible()

test/unit/node/heart.test.ts

@@ -116,11 +116,10 @@ describe("heartbeatTimer", () => {
     await heart.beat()
     jest.advanceTimersByTime(60 * 1000)
     // advanceTimersByTime fires the timer callback synchronously, but the
-    // callback awaits isActive() — drain the microtask queue so its rejection
-    // handler (which logs the warning) actually runs before we assert.
-    await Promise.resolve()
-    await Promise.resolve()
-    await Promise.resolve()
+    // callback awaits isActive(), so its rejection handler (which logs the
+    // warning) runs on the microtask queue. Yield one real macrotask turn
+    // (fake timers stub the global setImmediate) to drain it fully first.
+    await new Promise((resolve) => jest.requireActual("timers").setImmediate(resolve))
 
     expect(mockIsActive).toHaveBeenCalled()
     expect(logger.warn).toHaveBeenCalledWith(errorMsg)