Make reader signup prompts dismissible and coordinated

[abhi1693]

What changes and why?

After three articles, guests could receive a signup banner with no dismissal control while other account prompts competed for their attention. Add Not now and coordinate signup, topic onboarding, and Dev Card invitations through one shared reader provider.

• Dismissing either anonymous account invitation suppresses both for the session, including navigation and reloads. Existing anonymous Dev Card refusals remain respected; signed-in completion keeps its account-specific dismissal.
• Topic onboarding reserves priority while preferences load. Closing or saving it gives readers 30 seconds before another automatic invitation. Native article/account dialogs also take priority over invitations.
• Explicit Dev Card previews remain available after dismissal and can replace a signup banner. Chrome and Edge now render the existing shared /dev-card creator route.
• Signup stays hidden during authentication loading or outages. Blocked storage retains progress and dismissal within the mounted reader.
• The banner sits above mobile navigation, with touch-sized controls, so readers can continue navigating while it is visible.

Validation

Updated against master after #76 and the separate reader touch-fixture prerequisite #87. Hosted CI passes on 4424c0c895800a6660ef94ee7194359b20e3a491, including CI required, all CodeQL analyses and both Sonar checks. Auto-merge remains disabled.

• 2,642 backend unit tests, 1,136 PostgreSQL/Redis integration tests, 818 web tests and 648 admin tests passed, with no skips. Populated upgrades and recovery checks passed.
• Frontend lint/types and production builds, all security checks, ARM64 image checks and the API performance gate passed. No production speed improvement is claimed.
• Sonar passes with 93.5% new-code coverage, zero new duplication and no new issues. No threshold or source-coverage exclusion changes were needed; browser-only support lives in the existing browser-test directory.
• Local 52 focused prompt/signup/Dev Card/onboarding tests and affected-project commit hooks passed. Full production website journeys and all four browser suites for each built Chrome/Edge extension passed.
• Browser tests cover mutual session dismissal, existing dismissals, native-dialog priority, delayed onboarding, the pause after closing/saving, explicit card previews, storage failure and account switching. The conflict resolution retains Show direct articles sooner and shrink browser icons #75's pending/failed background-feed regressions alongside signup test articles, and all reader navigation/authentication/touch journeys pass.
• Review screenshots were captured locally in the original implementation. Native GitHub attachment upload is unavailable; screenshots remain untracked and are not hosted in repository files.
• GitHub's separate managed AI scan remains unavailable because its monthly quota is exhausted (HTTP 402); repository CodeQL checks passed.

Rollout notes

Existing devfeed:dev-card-promo-dismissed session values now suppress the signup banner too. If browser storage is blocked, a full reload resets the in-memory refusal. Updated web and extension builds are needed for consistent behavior. This PR does not deploy or publish extensions.

Ready for review

• The description explains the change and the validation results, including any gaps.
• Relevant documentation and regression tests are updated.

[github-actions]

PR reader API performance

Result: INCONCLUSIVE

1 improved · 1 inconclusive · 6 within threshold. Zero request failures across all six runs.

Base be90896b7376ac391f99a6ac0ae726b2ebe84a7e → PR 4424c0c895800a6660ef94ee7194359b20e3a491

Three independent runs per revision, each on a fresh GitHub-hosted ARM64 runner. 16 users, 60 seconds/run, 1,000 synthetic articles, cache off, five PgBouncer slots.

Latency comparison

All latency values are in milliseconds; lower is better. Values are medians of three runs.

Route	Base p95	PR p95	Change	Result
All requests	100	87	-13 (-13.0%)	Within threshold
Latest feed	140	110	-30 (-21.4%)	Improved
Feed pagination	97	79	-18 (-18.6%)	Within threshold
Article detail	75	58	-17 (-22.7%)	Within threshold
Source feed	94	75	-19 (-20.2%)	Within threshold
Topic feed	84	81	-3 (-3.6%)	Within threshold
Feed filters	88	67	-21 (-23.9%)	Inconclusive
Sources	42	37	-5 (-11.9%)	Within threshold
Topics	47	40	-7 (-14.9%)	Within threshold

Additional latency and throughput metrics

Each cell shows base → PR. Latencies are in milliseconds.

Endpoint	p50	p99	Requests/s
Aggregated	32 → 28	150 → 130	30.11 → 30.47
/v1/feed [latest]	45 → 42	170 → 150	8.66 → 8.87
/v1/feed [page]	28 → 26	140 → 110	3.49 → 4.06
/v1/articles/[id]	20 → 18	120 → 110	6.26 → 6.43
/v1/feed [source]	28 → 28	150 → 140	1.80 → 1.67
/v1/feed [topic]	27 → 26	150 → 110	1.78 → 2.01
/v1/feed/options	21 → 20	120 → 100	2.63 → 2.53
/v1/sources	11 → 11	60 → 54	2.63 → 2.55
/v1/topics	13 → 12	83 → 85	2.63 → 2.55

Individual runs

Run	Requests	Failures	Exit code
Base 1	1707	0	0
Base 2	1668	0	0
Base 3	1693	0	0
PR 1	1696	0	0
PR 2	1712	0	0
PR 3	1768	0	0

How to interpret this report

Regressed / Improved: a p95 regression needs >20% and >20 ms increase in the medians and at least two head samples versus the base median. Improvements use the inverse threshold. Within threshold means the change did not meet both thresholds.

Inconclusive: a within-revision p95 range >35% of its median and >20 ms is too noisy for a confident latency verdict.

Inconclusive latency comparisons are non-blocking: the check passes without claiming an improvement. Confirmed regressions and test/report errors fail the PR gate. Throughput is descriptive: paced users do not measure maximum capacity. This uncached public API test does not establish production health, browser performance or worker capacity. Separate runners can differ in hardware or host load; repetitions and noise checks reduce but cannot eliminate that uncertainty.

Full HTML/CSV reports and logs · attempt 1

[gitar-bot]

Code Review ✅ Approved

🟡 Medium risk · Coordinates reader invitations and session dismissals across web and browser extensions.

Makes reader signup prompts dismissible with a Not now button and coordinates signup, topic onboarding, and Dev Card invitations through a shared provider to prevent competing dialogs. Dismissed prompts are suppressed for the session, existing Dev Card refusals and signed-in completion states are preserved, and the banner sits above mobile navigation with touch-sized controls. Comprehensive validation across 787 web unit tests, 29 extension unit tests, browser journeys in Chrome and Edge, and desktop/mobile screenshots confirms the implementation. No issues found.

Review coverage

📋 Rules No rules evaluated

🧪 Functional validation Not enabled · Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
93.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud