fix(local-coding): count only new sync dates

[eshaanag]

Summary

• Count only truly new incoming local-coding dates against MAX_SESSIONS_PER_USER.
• Keep existing-date re-syncs allowed near the 365-session cap.
• Add regression coverage for the near-limit upsert case.

Why

This fixes #1530 as part of GSSoC 2026. The sync route was adding the full incoming session count to the user's existing row count before enforcing the cap, but the database upserts by (user_id, date). That meant normal re-syncs of existing dates could be rejected even though they would not create new rows.

Testing

• npm run test -- test/local-coding-sync.test.ts
• npm run lint
• npm run type-check
• node scripts/check-deps.js
• npm ci --dry-run
• npx -p node@20 -c 'node -v && npm run build'

Note: the Node 20 build completed successfully. Next.js still prints the existing upstream package-lock.json parse warning from conflict markers, but this PR does not touch the lockfile.

Closes #1530

[vercel]

@eshaanag is attempting to deploy a commit to the PRIYANSHU DOSHI's projects Team on Vercel.

A member of the Team first needs to authorize it.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

[eshaanag]

Rebased this branch onto current main and pushed a follow-up after checking the failed Playwright report. The local-coding fix is still the core change, and the extra CI fixes cover the standalone E2E server missing static assets plus dashboard/public-profile auth edge cases that were breaking the smoke suite. Local validation is green: lint, type-check, the local-coding sync regression test, Node 20 production build, and the full Playwright suite.