fix(test): credentials.upload reflects record into cache (not invalidate)

Stale assertion pinned the buggy pre-G1.6 behavior (the test name
"upload invalidates the cache" literally describes the bug). The
audit's correction makes upload mirror the returned record into the
store so the card updates immediately — update the assertion to
match the corrected behavior.

frontend/test/credentials.spec.js

@@ -27,12 +27,17 @@ describe('credentials store', () => {
     expect(s.byPlatform.get('patreon').credential_type).toBe('cookies')
   })
 
-  it('upload invalidates the cache', async () => {
+  it('upload reflects the returned record into the cache', async () => {
+    // The previous behavior was to delete the cache entry on upload, which
+    // briefly showed "no credential" until a follow-up loadAll() resolved.
+    // Audit 2026-06-02 corrected this: upload now stores the returned
+    // record directly so the card updates immediately.
     const s = useCredentialsStore()
-    s.byPlatform.set('patreon', { platform: 'patreon' })
-    stubFetch(() => ({ status: 201, body: { platform: 'patreon', credential_type: 'cookies' } }))
+    s.byPlatform.set('patreon', { platform: 'patreon', credential_type: 'token' })
+    const fresh = { platform: 'patreon', credential_type: 'cookies' }
+    stubFetch(() => ({ status: 201, body: fresh }))
     await s.upload('patreon', 'cookies', 'NETSCAPE_CONTENT')
-    expect(s.byPlatform.has('patreon')).toBe(false)
+    expect(s.byPlatform.get('patreon')).toEqual(fresh)
   })
 
   it('remove deletes and invalidates the cache', async () => {