UI audit follow-ups: stale status, trigger sizing, motion tokens (CL-6487)

[TheGreatAxios]

Fix findings 1,2,4,5 from the Apple/Stripe/Vercel audit (finding 3 was PR #243):

• Settings › Connections and Plugins now poll on visibilitychange, window focus, and a 30s interval while visible so a Connected pill cannot lie silently after a credential expires elsewhere.
• Sidebar row menu trigger meets the 40px floor (1.6rem + ::after inset:-8px), matching the existing chat pin toggle idiom.
• DESIGN.md motion tokens reconciled with react-ui shipped theme.css: --ease-out is cubic-bezier(.23,1,.32,1), --ease-spring and --ease-in-out documented with durations.
• Entrance durations brought under the 150-300ms ceiling (onboarding-phase-in 320ms -> 280ms; chat tip already fixed).
• chat-ui --chat-ease fallback now matches react-ui --ease-out and a central prefers-reduced-motion comment is added.

Also ignore apps/hub/.data in eslint to keep local hub state from polluting lint.

[TheGreatAxios]

Reviewed against current main (1a28113) and the pinned @corbits/react-ui build (3b122812). CI is green; the branch is 134 commits behind but merges cleanly.

Must fix

• No tests accompany any of this. plugins-page.tsx and connections-section.tsx each gain a new useEffect that wires visibilitychange/focus/setInterval into a reload-key bump gated on tenantId — exactly the kind of state logic (event dedup, cleanup on unmount/tenant change, visibility gating) that silently breaks in a later refactor with no regression test to catch it. AGENTS.md's commit convention (tests first) and "meaningful red/green tests" expectation apply here; this PR is a single commit with zero test changes.

Consider

• Switching back to the tab fires both visibilitychange and focus in the same tick, so setPluginsReloadKey/setReloadKey bump twice almost simultaneously in both files — harmless (the later fetch's response wins via the existing cancelled guard) but it's two network calls where one would do.
• The setInterval(refresh, 30_000) keeps ticking every 30s even while the tab is hidden; it only no-ops inside the callback rather than being cleared/restarted on visibilitychange. Minor, but worth a comment if intentional.
• .chat-sidebar-row-menu-trigger's hover/focus transition is still 120ms (app.css:653-658, pre-existing value, PR only added properties onto it) — under DESIGN.md's own "150-300ms" floor that this PR just re-documented in the Motion section, and not expressed via --duration-micro. Not introduced by this PR, but the PR's stated goal is exactly this kind of token reconciliation, so it's a miss of scope.
• onboarding-phase-in's animation still uses a bare ease keyword and raw seconds rather than var(--ease-out) / var(--duration-large, 300ms), despite the new DESIGN.md guidance those are the canonical tokens for this class of motion. It is now inside the ceiling (280ms), so this is style, not correctness.

Verified

• DESIGN.md's rewritten Motion section (--ease-out: cubic-bezier(.23,1,.32,1), --ease-spring: cubic-bezier(.2,.9,.3,1.15), --ease-in-out: cubic-bezier(.65,0,.35,1), --duration-micro/standard/large: 150/200/300ms) matches byte-for-byte the tokens actually shipped in the pinned react-ui theme.css (github:corbitsdev/react-ui#3b122812). The previous docs materially disagreed with react-ui's --ease-out value; this fixes a real drift.
• The 40px trigger sizing (chat-sidebar-row-menu-trigger: 1.6rem box + ::after { inset: -8px } = 41.6px effective hit area) meets the ≥40px floor DESIGN.md states elsewhere for Chrome/hit areas. There is no numeric size token in the design system for this — the existing pin-toggle idiom (app.css:1844) already uses the same raw 1.6rem, so the literals here are consistent with established practice, not a new violation.
• CI: build-test, db-suites, e2e, isolation, lint, structural, typecheck all pass.
• git merge-tree $(git merge-base origin/main origin/cl-6487-...) origin/main origin/cl-6487-... produces 0 <<<<<<< conflict markers; the two files main also touched (plugins-page.tsx's effects block, chat-ui/styles.css's easing values, connections-section.tsx) merge cleanly.

Rebase needed: yes (134 commits behind main), 0 conflicts detected by merge-tree.

[TheGreatAxios]

Addressed the latest review:

Must-fix

• Added regression tests for both refresh-on-visibility effects (apps/web/test/plugins-page.test.tsx, packages/settings-ui/test/connections-refresh-on-visibility.test.tsx): a same-tick visibilitychange+focus pair reloads exactly once, nothing fires while tenantId is null, and listeners/interval are removed on unmount.

Consider

• Applied: deduped the same-tick visibilitychange+focus double bump in both plugins-page.tsx and connections-section.tsx via a shared refreshWhenVisible handler with a microtask guard — one scheduled reload per tick, which the new tests assert.
• Applied (one-liner): .chat-sidebar-row-menu-trigger's transition now uses var(--duration-micro, 150ms) instead of the bare 120ms.
• Applied (one-liner): onboarding-phase-in's animation now uses var(--duration-large, 300ms) and var(--ease-out, ease) instead of 0.28s ease.
• Skipped: the setInterval continuing to tick every 30s while hidden (only no-oping inside the callback rather than being cleared/restarted on visibilitychange) — not a one-liner; leaving as-is since it's explicitly called out as minor/optional in the review.

Also rebased onto current main (picked up the hub-client removal, @workbench/connections → @corbits/connections rename, and the catalog/templates move — no conflicts, just import path fixups from the rebase).