fix(FN-2525): harden remote access auth and tunnel regression coverage

- Add regression tests across CLI, core, dashboard, and engine for remote access auth, settings parity, and serve/TUI callback wiring
- Expand dashboard route and modal coverage for remote settings/auth flows including node environment behaviors
- Redact provider-switch failure details in tunnel process manager to avoid leaking sensitive provider diagnostics
- Update route registration and engine lifecycle tests to lock in remote-access behavior under real execution paths

packages/cli/src/commands/__tests__/serve.test.ts

@@ -360,6 +360,16 @@ const mocks = vi.hoisted(() => {
     });
     const notifier = notifierCtor();
 
+    const remoteStatus = {
+      provider: "cloudflare" as const,
+      state: "running" as const,
+      pid: 1234,
+      startedAt: new Date().toISOString(),
+      stoppedAt: null,
+      url: "https://remote.example.com",
+      lastError: null,
+    };
+
     const engine = {
       start: vi.fn(async () => {
         await store.init();
@@ -412,6 +422,15 @@ const mocks = vi.hoisted(() => {
         getMissionAutopilot: () => missionAutopilot,
         getMissionExecutionLoop: () => missionExecutionLoop,
       })),
+      getRemoteTunnelManager: vi.fn(() => ({ getStatus: vi.fn(() => remoteStatus) })),
+      getRemoteTunnelRestoreDiagnostics: vi.fn(() => ({
+        outcome: "skipped",
+        reason: "not_attempted",
+        at: new Date().toISOString(),
+        provider: null,
+      })),
+      startRemoteTunnel: vi.fn(async () => remoteStatus),
+      stopRemoteTunnel: vi.fn(async () => ({ ...remoteStatus, state: "stopped" as const, provider: null, pid: null, url: null })),
       onMerge: vi.fn().mockResolvedValue(undefined),
     };
     projectEngineInstances.push(engine);
@@ -693,6 +712,22 @@ describe("runServe", () => {
     await triggerSignal("SIGINT");
   });
 
+  it("passes remote-capable engine hooks into headless createServer for fn serve parity", async () => {
+    const { createServer } = await import("@fusion/dashboard");
+
+    await runServe(0, {});
+
+    expect(createServer).toHaveBeenCalledTimes(1);
+    const serverOptions = createServer.mock.calls[0][1];
+    expect(serverOptions).toMatchObject({ headless: true });
+    expect(serverOptions.engine).toBeDefined();
+    expect(typeof serverOptions.engine.startRemoteTunnel).toBe("function");
+    expect(typeof serverOptions.engine.stopRemoteTunnel).toBe("function");
+    expect(typeof serverOptions.engine.getRemoteTunnelManager).toBe("function");
+
+    await triggerSignal("SIGINT");
+  });
+
   it("sets enginePaused when started with paused=true", async () => {
     await runServe(0, { paused: true });