fix(#562): silence post-login console errors + modernize HTTP client

[JoshuaVSherman]

Closes #562.

Summary

• COOP header (the actual Clean up console errors after login + modernize server & HTTP client #562 fix) — Express now sets Cross-Origin-Opener-Policy: same-origin-allow-popups on every response, so Google Identity Services' popup-flow no longer trips repeated window.closed warnings post-login.
• Facebook embed: retired Like Box → modern Page Plugin — NarrowFacebookFeed and WideFacebookFeed now embed https://www.facebook.com/plugins/page.php?...&tabs=timeline instead of the deprecated likebox.php. Page renders the actual FB timeline again, on a supported plugin. (Note: the same FB JS bundle is loaded either way, so the third-party unload / ErrorUtils console warnings may persist — those originate inside Facebook's iframe and aren't fixable from our code.)
• server.js → server.mjs (ESM) — app.listen is gated behind a main-module check so vitest can import the app without binding a port. Procfile, CircleCI smoketest, and eslint ignore list updated to match.
• Drop superagent and axios, use native fetch — converted src/lib/fetch.ts, src/App/AppTemplate/GoogleButtons/utils.tsx, src/providers/Content.provider.tsx, src/containers/AdminDashboard/utils.tsx, src/containers/AdminDashboard/pictures.utils.tsx, src/containers/News/utilsN.tsx, plus all corresponding test specs (which now stub global.fetch via vi.stubGlobal).
• First server-side test coverage — test/server.spec.ts uses native fetch against an app.listen(0) ephemeral port (no supertest dep) to assert the COOP header is set on responses.
• CircleCI hygiene — added explicit workflows: { build-and-test: { jobs: [build] } } block to silence the language-server "Job is unused" warning. No behavior change (CI was using the legacy implicit-build path before).

Automated verification (already green locally)

• npm run test:lint — clean
• npm run typecheck — clean
• npm run test:unit — 46 files / 121 tests pass (118 → 121: +2 server tests, +1 fetch non-ok branch)
• WideFacebookFeed snapshot regenerated to reflect the Page Plugin iframe URL
• CircleCI smoketest now exercises node server.mjs

Manual testing checklist (please run before merge)

COOP / login (the #562 fix)

• Deploy to a non-prod env (or npm run build && PORT=7777 node server.mjs locally) and visit the homepage. Confirm Cross-Origin-Opener-Policy: same-origin-allow-popups is in the response headers (DevTools → Network → click any document → Headers).
• Click Login, complete a Google OAuth popup login. Expected: no Cross-Origin-Opener-Policy policy would block the window.closed call warnings in the console during/after popup close. Login completes successfully.
• Click Logout. Verify the session clears and you're back to the public view.

Facebook embed (Page Plugin replacement)

• Homepage at narrow viewport (mobile width): confirm the Facebook timeline now renders inside an iframe between horizontal rules, with the "Like Us On Facebook" link above it.
• Homepage at wide viewport (≥1004px): same check on the right column under "View Full Calendar".
• Note: Facebook's own JS may still emit unload / ErrorUtils warnings — those come from inside the FB iframe and are unrelated to the COOP fix. They are not part of Clean up console errors after login + modernize server & HTTP client #562's success criteria.

Endpoints touched by the axios → fetch conversion (most behavior-sensitive area)

For each, confirm functional parity vs. production:

• Homepage content loads (book/one?type=homePageContent etc. — no infinite spinners, content renders).
• Pictures sliders populate (book?type=musicPics/familyPics/youthPics/habitatPics/otherPics).
• News page renders forum posts in date-descending order.
• As an admin, add a news item: confirm 201 success path notifies and refreshes.
• As an admin, edit page content (Beliefs/Stewardship/etc.): confirm 200 success path, AND the 400-→-POST-create fallback in handlePutError (try editing a type that doesn't exist yet — should auto-create).
• As an admin, upload/edit/delete a picture in the Admin Dashboard.
• Trigger a backend failure (e.g. point BackendUrl to a bad host briefly) and verify warning toasts still appear instead of silent failures.

Auth flow specifically

• Login posts to BackendUrl/user/auth/google with Content-Type: application/json (DevTools → Network → check the request).
• After successful auth, BackendUrl/user/{id} is fetched with Authorization: Bearer <token> and the user object hydrates the auth context.

Smoketest parity

• rm -rf node_modules package-lock.json && npm install --omit=dev && PORT=7777 node server.mjs starts the server and curl http://localhost:7777/ returns 200 with the COOP header (matches the CircleCI smoketest job).

🤖 Generated with Claude Code