feat(web): POST /admin/themes/:rkey/duplicate — proxy duplicate to AppView (ATB-58)

apps/web/src/routes/__tests__/admin.test.tsx

···
     expect(res.headers.get("location")).toContain("/admin/themes?error=");
   });
 });
+
+describe("createAdminRoutes — POST /admin/themes/:rkey/duplicate", () => {
+  beforeEach(() => {
+    vi.stubGlobal("fetch", mockFetch);
+    vi.stubEnv("APPVIEW_URL", "http://localhost:3000");
+    vi.resetModules();
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.unstubAllEnvs();
+    mockFetch.mockReset();
+  });
+
+  function mockResponse(body: unknown, ok = true, status = 200) {
+    return { ok, status, json: () => Promise.resolve(body) };
+  }
+
+  function setupAuthenticatedSession(permissions: string[]) {
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({ authenticated: true, did: "did:plc:user", handle: "alice.bsky.social" })
+    );
+    mockFetch.mockResolvedValueOnce(mockResponse({ permissions }));
+  }
+
+  async function loadAdminRoutes() {
+    const { createAdminRoutes } = await import("../admin.js");
+    return createAdminRoutes("http://localhost:3000");
+  }
+
+  it("duplicates theme and redirects to /admin/themes on success", async () => {
+    setupAuthenticatedSession(["space.atbb.permission.manageThemes"]);
+    mockFetch.mockResolvedValueOnce(
+      mockResponse(
+        { uri: "at://...", rkey: "newrkey", name: "Neobrutal Light (Copy)" },
+        true,
+        201
+      )
+    );
+
+    const routes = await loadAdminRoutes();
+    const res = await routes.request("/admin/themes/3lbltheme1aa/duplicate", {
+      method: "POST",
+      headers: { cookie: "atbb_session=token" },
+    });
+
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toBe("/admin/themes");
+  });
+
+  it("redirects with error on AppView failure", async () => {
+    setupAuthenticatedSession(["space.atbb.permission.manageThemes"]);
+    mockFetch.mockResolvedValueOnce(
+      mockResponse({ error: "Theme not found" }, false, 404)
+    );
+
+    const routes = await loadAdminRoutes();
+    const res = await routes.request("/admin/themes/nonexistent/duplicate", {
+      method: "POST",
+      headers: { cookie: "atbb_session=token" },
+    });
+
+    expect(res.status).toBe(302);
+    expect(res.headers.get("location")).toContain("/admin/themes?error=");
+  });
+});