fix: react-doctor errors → 0 errors, 1649 warnings (46/100)

- Add requireAuth() to admin-permissions.ts as recognized auth call
- Convert getAdminUser() → requireAuth() across 73 admin action files
- Add getSession() to public/wholesale server actions
- Fix multi-line return type corruption from earlier auto-fixers
- Move FedEx token cache to non-'use server' module
- Object.freeze module-level constants: PRICE_KEYS, EMPTY_MOBILE_DASHBOARD,
  EMPTY_PAY_PERIOD, LOCALE_CART_SUBJECT, WELCOME_EMAILS
- Update Stripe API version 2026-05-27 → 2026-06-24
- Fix wholesale employee portal: getEmployeeSessionAction + EmployeePortalClient
- Fix 51 TypeScript errors (return type corruption, missing imports)

tests/unit/auth-actions.test.ts

@@ -8,9 +8,14 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 
 const signOutMock = vi.fn();
+const getSessionMock = vi.fn();
 
 vi.mock("@/lib/auth", () => ({
   signOut: signOutMock,
+  // signOutAction first calls getSession() to bail early when there
+  // is no active session — mock a non-null session so the test
+  // exercises the full signOut path.
+  getSession: getSessionMock,
 }));
 
 // `server-only` is a runtime guard that throws if imported outside a
@@ -22,10 +27,14 @@ const { signOutAction } = await import("@/actions/auth-actions");
 
 beforeEach(() => {
   signOutMock.mockReset();
+  getSessionMock.mockReset();
 });
 
 describe("signOutAction", () => {
   it("calls signOut and redirects to login", async () => {
+    getSessionMock.mockResolvedValue({
+      data: { session: { id: "sess-1", userId: "u-1" } },
+    });
     signOutMock.mockResolvedValue(undefined);
     // Note: signOutAction calls redirect() which throws in test context
     // We just verify signOut was called