test(qua-37): cronoclient + CLI binary E2E smoke (Track A)

[Terastar-Paperclip]

Summary

Track A of the QUA-37 release gate: agent-runnable test coverage for the layers that had none after the Phase 3b clean-room swap.

• internal/cronotest: shared permissive httptest fake (login + GWT-RPC + /export) reusable across cronoclient unit tests and CLI-binary E2E. The strict wire-shape contract is already pinned by internal/cronoapi/client_test.go; this fake exists purely to drive the wrapper.
• internal/cronoclient/client_test.go: drives all five export methods (Servings/Exercises/Biometrics/Nutrition/Notes) through the wrapper across a real login/logout round-trip; pins the typed-record shapes and the []map[string]string conversion for nutrition/notes.
• cmd/clie2e_test.go: builds the binary in TestMain and execs it against the fake. Covers nutrition --format json, nutrition --format markdown, servings --format json, the unknown-format rejection, and the two no-network commands (auth status, prime).
• cronoclient.NewLoggedIn now honors CRONOMETER_BASE_URL so the binary E2E can point at httptest. Production users never set it.

Why this PR exists

Per QUA-37 interaction 88ef1e92, the v1.1.0 release gate is Track A + Track B:

• A (this PR) — synthetic E2E smoke we can run on every CI build.
• B (still open) — DT runs a manual probe against a real Cronometer account to confirm the wire shape we authored matches what cronometer.com actually serves today. Our fake validates what we think the wire looks like; it cannot catch upstream drift.

No release until both are green. Tagging v1.1.0 is deliberately not in this PR.

Honest gap

The fake is built from our own reading of the captured fixtures. If Cronometer rotates a header, response shape, or CSV column we never saw during Phase 3a, these tests will keep passing while production breaks. Track B is the only mitigation that catches that drift.

Test plan

• go test ./... — all suites green, including the existing cronoapi storyboard tests.
• go vet ./... — clean.
• Compat tests (-tags=compat) unaffected — no flag/output-surface changes.
• DT runs Track B against a real Cronometer account post-merge.

🤖 Generated with Claude Code

[DTTerastar]

Thanks for rebasing this. The PR is mergeable now and the typed JSON assertions look updated, but I do not think we should approve it yet.

The remaining blocker is in the CLI subprocess E2E tests: in still runs the binary with the real session cache enabled. I reproduced this locally with ? github.com/quantcli/crono-export-cli [no test files]
ok github.com/quantcli/crono-export-cli/cmd (cached)
ok github.com/quantcli/crono-export-cli/internal/cronoapi (cached)
ok github.com/quantcli/crono-export-cli/internal/cronoclient (cached); it wrote a fake session to my real cache path at .

That makes the tests environment-dependent and can clobber a developer's local cache. It can also mask the fake login path if a matching cached session already exists. The unit tests already handle this with in ; the CLI E2E env should do the same, or alternatively isolate / to a temp dir for each subprocess test.

Once that cache isolation is fixed, I think this is approvable.

[Terastar-Paperclip]

Cache isolation fixed

@DTTerastar — good catch. Reproduced locally (the test run wrote a fake alice@example.com session to my real ~/.cache/crono-export/session.json), then applied the fix in 69afb69.

Fix: runCLI now mirrors session_test.go's redirect — per-test t.TempDir() exported as HOME, XDG_CACHE_HOME, and LOCALAPPDATA (covering Linux/macOS/Windows os.UserCacheDir() semantics). Applied before the caller's env so a future test can still override if it needs to.

Verified: go test ./... green, ~/.cache/crono-export/ no longer created.

Re-requesting your review.

[DTTerastar]

Correction to my previous review body, which was mangled by shell formatting.

Please isolate the CLI subprocess E2E tests from the real session cache before approval. fakeEnv in cmd/clie2e_test.go still runs the binary with the cache enabled. I reproduced this locally with go test ./..., and it wrote a fake alice@example.com session to my real cache path: ~/Library/Caches/crono-export/session.json.

That makes the tests environment-dependent and can overwrite a local developer cache. It can also mask the intended fake login path if a matching cached session already exists. The cronoclient unit E2E helper already handles this by setting CRONOMETER_NO_CACHE=1 in withFake; the CLI fakeEnv should do the same, or each subprocess test should isolate XDG_CACHE_HOME/HOME to a temp dir.

Once that cache isolation is fixed, I think this is approvable.