fix(ui): attach keyboard shortcuts during setup, not after auth bootstrap

[gocanto]

What & why

This branch carries two unrelated-but-bundled changes:

1. Fix: keyboard shortcuts silently failing for returning users

The global keydown listener was only attached inside useAppSession's onMounted callback after await bootstrapAuth(). For a returning authenticated user, bootstrap flips authMode to 'ready' (rendering the diff UI) and then awaits enterApp() (load prefs, refresh repos, open repo). If any of those awaits threw or hung, useKeyboardShortcuts was never reached and every shortcut silently failed — no console error, since those steps route failures through onError handlers.

Change: wire useKeyboardShortcuts synchronously in useAppSession's setup body so the listener attaches immediately and independently of bootstrap timing. This also lets the composable's own onMounted/onUnmounted register in a valid instance context (the previous post-await call leaked the listener).

Also: add the missing return in the onOpenSearch branch, and a unit test covering attach, ArrowUp/Down aliases, the disabled gate, input suppression, and unmount cleanup.

Files:

• packages/ui/src/composables/useAppSession.ts
• packages/ui/src/composables/useKeyboardShortcuts.ts
• packages/ui/tests/useKeyboardShortcuts.test.ts

2. Docs: launch marketing assets (marketing/)

A reusable marketing/ folder with ready-to-publish pitch content and on-brand social images for the beta launch:

• posts/ — platform-tailored pitches for LinkedIn (launch announcement), X (builder thread), and Reddit (problem/story with beta caveats), each with suggested imagery + alt text.
• cards/ — four branded social cards (hero/OG, screenshot, features, privacy) rendered at 2× from on-brand HTML/CSS templates in cards/src/ that reuse the app's colors, Fira Code font, logo, and screenshots.
• README.md — index mapping posts → cards and documenting how to regenerate.

Static md/html/css/png assets only; no app code involved.

Reviewer notes

• The two changes are independent; happy to split the marketing commit into its own PR if preferred.
• The marketing posts contain live repo/release links and are written for a public launch — publishing is left to the maintainer; nothing posts automatically.
• Cards can be regenerated from marketing/cards/src/ (see marketing/README.md).

Testing

• useKeyboardShortcuts unit test added and covers attach/aliases/disabled-gate/input-suppression/cleanup.
• Marketing assets verified by rendering: correct aspect ratios, no broken images, no clipping.

[gemini-code-assist]

Code Review

This pull request introduces marketing assets, including launch posts for LinkedIn, Reddit, and X, along with HTML/CSS templates for social cards. On the codebase side, it refactors keyboard shortcut registration in useAppSession.ts to occur synchronously during setup rather than inside onMounted after authentication bootstrapping, preventing shortcuts from breaking if authentication fails or hangs. It also adds a missing return statement in useKeyboardShortcuts.ts and introduces a comprehensive test suite in useKeyboardShortcuts.test.ts. There are no review comments to assess, so no additional feedback is provided.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.