fix(FN-2525): harden remote access auth and tunnel regression coverage

- Add regression tests across CLI, core, dashboard, and engine for remote access auth, settings parity, and serve/TUI callback wiring
- Expand dashboard route and modal coverage for remote settings/auth flows including node environment behaviors
- Redact provider-switch failure details in tunnel process manager to avoid leaking sensitive provider diagnostics
- Update route registration and engine lifecycle tests to lock in remote-access behavior under real execution paths

packages/core/src/__tests__/settings-parity.test.ts

@@ -59,6 +59,16 @@ describe("settings key parity", () => {
     expect(DEFAULT_PROJECT_SETTINGS.heartbeatMultiplier).toBe(1);
   });
 
+  it("keeps remoteAccess scoped to project settings only", () => {
+    const globalKeys = GLOBAL_SETTINGS_KEYS as readonly string[];
+    const projectKeys = PROJECT_SETTINGS_KEYS as readonly string[];
+
+    expect(projectKeys).toContain("remoteAccess");
+    expect(globalKeys).not.toContain("remoteAccess");
+    expect(DEFAULT_PROJECT_SETTINGS.remoteAccess).toBeDefined();
+    expect((DEFAULT_GLOBAL_SETTINGS as Record<string, unknown>).remoteAccess).toBeUndefined();
+  });
+
   it("No key appears in both GLOBAL_SETTINGS_KEYS and PROJECT_SETTINGS_KEYS", () => {
     const projectKeySet = new Set(PROJECT_SETTINGS_KEYS as readonly string[]);
     const overlap = (GLOBAL_SETTINGS_KEYS as readonly string[]).filter((key) => projectKeySet.has(key));

packages/core/src/__tests__/store.test.ts

@@ -2656,6 +2656,24 @@ describe("TaskStore", () => {
       },
     };
 
+    it("round-trips nested remoteAccess settings with both providers, token strategy, and lifecycle", async () => {
+      await store.updateSettings({ remoteAccess: baseRemoteAccess });
+
+      const settings = await store.getSettings();
+      expect(settings.remoteAccess).toEqual(baseRemoteAccess);
+
+      const { project, global } = await store.getSettingsByScope();
+      expect(project.remoteAccess).toEqual(baseRemoteAccess);
+      expect((global as Record<string, unknown>).remoteAccess).toBeUndefined();
+
+      store.close();
+      store = new TaskStore(rootDir, globalDir);
+      await store.init();
+
+      const reloaded = await store.getSettings();
+      expect(reloaded.remoteAccess).toEqual(baseRemoteAccess);
+    });
+
     it("patching remoteAccess.providers.tailscale preserves providers.cloudflare", async () => {
       await store.updateSettings({ remoteAccess: baseRemoteAccess });