fix: addresses PR review findings across 22 issues

- refactor(api): extracts executeLightCombinedQuery shared helper, eliminating
  ~80 lines of duplication between graphqlLightCombinedSearch and
  graphqlGlobalUserSearch
- fix(api): removes superfluous !userLogin from early exit guard
- fix(api): guards onLightData to only fire when results exist
- perf(api): swaps PR_SEARCH_QUERY to LIGHT_PR_SEARCH_QUERY in
  discoverUpstreamRepos for lower GraphQL point cost
- fix(api): unifies VALID_LOGIN with VALID_TRACKED_LOGIN regex
- refactor(dashboard): extracts buildSurfacedByUsers helper, removes
  duplicated surfacedByBadge logic from IssuesTab and PullRequestsTab
- fix(dashboard): guards allUsers memo against empty login
- fix(dashboard): adds stale user-filter guard for removed tracked users
- fix(settings): renumbers section comments after Tracked Users insertion
- refactor(tabs): imports TrackedUser type instead of inline declaration
- perf(onboarding): uses Set for manualUpstreamRepos dedup
- test: adds ConfigSchema, TrackedUsersSection, RepoSelector, and
  api-users coverage for identified gaps

Author: wgordon17

src/app/components/dashboard/DashboardPage.tsx

@@ -307,10 +307,14 @@ export default function DashboardPage() {
   }));
 
   const userLogin = createMemo(() => user()?.login ?? "");
-  const allUsers = createMemo(() => [
-    { login: userLogin().toLowerCase(), label: "Me" },
-    ...config.trackedUsers.map((u: TrackedUser) => ({ login: u.login, label: u.login })),
-  ]);
+  const allUsers = createMemo(() => {
+    const login = userLogin().toLowerCase();
+    if (!login) return [];
+    return [
+      { login, label: "Me" },
+      ...config.trackedUsers.map((u: TrackedUser) => ({ login: u.login, label: u.login })),
+    ];
+  });
 
   return (
     <div class="min-h-screen bg-base-200">

src/app/components/dashboard/IssuesTab.tsx

@@ -1,9 +1,9 @@
 import { createEffect, createMemo, createSignal, For, Show } from "solid-js";
-import { config } from "../../stores/config";
+import { config, type TrackedUser } from "../../stores/config";
 import { viewState, setSortPreference, setTabFilter, resetTabFilter, resetAllTabFilters, ignoreItem, unignoreItem, toggleExpandedRepo, setAllExpanded, pruneExpandedRepos, type IssueFilterField } from "../../stores/view";
 import type { Issue } from "../../services/api";
 import ItemRow from "./ItemRow";
-import UserAvatarBadge from "../shared/UserAvatarBadge";
+import UserAvatarBadge, { buildSurfacedByUsers } from "../shared/UserAvatarBadge";
 import IgnoreBadge from "./IgnoreBadge";
 import SortDropdown from "../shared/SortDropdown";
 import type { SortOption } from "../shared/SortDropdown";
@@ -22,7 +22,7 @@ export interface IssuesTabProps {
   loading?: boolean;
   userLogin: string;
   allUsers?: { login: string; label: string }[];
-  trackedUsers?: { login: string; avatarUrl: string; name: string | null }[];
+  trackedUsers?: TrackedUser[];
 }
 
 type SortField = "repo" | "title" | "author" | "createdAt" | "updatedAt" | "comments";
@@ -108,8 +108,11 @@ export default function IssuesTab(props: IssuesTabProps) {
       }
 
       if (tabFilter.user !== "all") {
-        const surfacedBy = issue.surfacedBy ?? [props.userLogin.toLowerCase()];
-        if (!surfacedBy.includes(tabFilter.user)) return false;
+        const validUser = !props.allUsers || props.allUsers.some(u => u.login === tabFilter.user);
+        if (validUser) {
+          const surfacedBy = issue.surfacedBy ?? [props.userLogin.toLowerCase()];
+          if (!surfacedBy.includes(tabFilter.user)) return false;
+        }
       }
 
       meta.set(issue.id, { roles });
@@ -319,10 +322,7 @@ export default function IssuesTab(props: IssuesTabProps) {
                                 surfacedByBadge={
                                   props.trackedUsers && props.trackedUsers.length > 0
                                     ? <UserAvatarBadge
-                                        users={(issue.surfacedBy ?? []).flatMap((login) => {
-                                          const u = trackedUserMap().get(login);
-                                          return u ? [{ login: u.login, avatarUrl: u.avatarUrl }] : [];
-                                        })}
+                                        users={buildSurfacedByUsers(issue.surfacedBy, trackedUserMap())}
                                         currentUserLogin={props.userLogin}
                                       />
                                     : undefined

src/app/components/dashboard/PullRequestsTab.tsx

@@ -1,11 +1,11 @@
 import { createEffect, createMemo, createSignal, For, Show } from "solid-js";
-import { config } from "../../stores/config";
+import { config, type TrackedUser } from "../../stores/config";
 import { viewState, setSortPreference, ignoreItem, unignoreItem, setTabFilter, resetTabFilter, resetAllTabFilters, toggleExpandedRepo, setAllExpanded, pruneExpandedRepos, type PullRequestFilterField } from "../../stores/view";
 import type { PullRequest } from "../../services/api";
 import { deriveInvolvementRoles, prSizeCategory } from "../../lib/format";
 import ExpandCollapseButtons from "../shared/ExpandCollapseButtons";
 import ItemRow from "./ItemRow";
-import UserAvatarBadge from "../shared/UserAvatarBadge";
+import UserAvatarBadge, { buildSurfacedByUsers } from "../shared/UserAvatarBadge";
 import StatusDot from "../shared/StatusDot";
 import IgnoreBadge from "./IgnoreBadge";
 import SortDropdown from "../shared/SortDropdown";
@@ -25,7 +25,7 @@ export interface PullRequestsTabProps {
   loading?: boolean;
   userLogin: string;
   allUsers?: { login: string; label: string }[];
-  trackedUsers?: { login: string; avatarUrl: string; name: string | null }[];
+  trackedUsers?: TrackedUser[];
 }
 
 type SortField = "repo" | "title" | "author" | "createdAt" | "updatedAt" | "checkStatus" | "reviewDecision" | "size";
@@ -191,8 +191,11 @@ export default function PullRequestsTab(props: PullRequestsTabProps) {
       }
 
       if (tabFilters.user !== "all") {
-        const surfacedBy = pr.surfacedBy ?? [props.userLogin.toLowerCase()];
-        if (!surfacedBy.includes(tabFilters.user)) return false;
+        const validUser = !props.allUsers || props.allUsers.some(u => u.login === tabFilters.user);
+        if (validUser) {
+          const surfacedBy = pr.surfacedBy ?? [props.userLogin.toLowerCase()];
+          if (!surfacedBy.includes(tabFilters.user)) return false;
+        }
       }
 
       meta.set(pr.id, { roles, sizeCategory });
@@ -463,10 +466,7 @@ export default function PullRequestsTab(props: PullRequestsTabProps) {
                                 surfacedByBadge={
                                   props.trackedUsers && props.trackedUsers.length > 0
                                     ? <UserAvatarBadge
-                                        users={(pr.surfacedBy ?? []).flatMap((login) => {
-                                          const u = trackedUserMap().get(login);
-                                          return u ? [{ login: u.login, avatarUrl: u.avatarUrl }] : [];
-                                        })}
+                                        users={buildSurfacedByUsers(pr.surfacedBy, trackedUserMap())}
                                         currentUserLogin={props.userLogin}
                                       />
                                     : undefined

src/app/components/onboarding/RepoSelector.tsx

@@ -355,9 +355,10 @@ export default function RepoSelector(props: RepoSelectorProps) {
   }
 
   // Manually-added upstream repos not in the discovered list
-  const manualUpstreamRepos = createMemo(() =>
-    (props.upstreamRepos ?? []).filter(r => !discoveredRepos().some(d => d.fullName === r.fullName))
-  );
+  const manualUpstreamRepos = createMemo(() => {
+    const discoveredSet = new Set(discoveredRepos().map(r => r.fullName));
+    return (props.upstreamRepos ?? []).filter(r => !discoveredSet.has(r.fullName));
+  });
 
   // Upstream repos visible in the discovery list (discovered + manually added that aren't org repos)
   const filteredDiscovered = createMemo(() => {

src/app/components/settings/SettingsPage.tsx

@@ -378,7 +378,7 @@ export default function SettingsPage() {
           </SettingRow>
         </Section>
 
-        {/* Section 3: GitHub Actions */}
+        {/* Section 4: GitHub Actions */}
         <Section title="GitHub Actions">
           <SettingRow
             label="Max workflows per repo"
@@ -418,7 +418,7 @@ export default function SettingsPage() {
           </SettingRow>
         </Section>
 
-        {/* Section 4: Notifications */}
+        {/* Section 5: Notifications */}
         <Section title="Notifications">
           <SettingRow
             label="Enable notifications"
@@ -510,7 +510,7 @@ export default function SettingsPage() {
           </SettingRow>
         </Section>
 
-        {/* Section 5: Appearance */}
+        {/* Section 6: Appearance */}
         <Section title="Appearance">
           <div class="px-4 py-2 border-b border-base-300">
             <p class="text-sm font-medium text-base-content mb-2">Theme</p>
@@ -550,7 +550,7 @@ export default function SettingsPage() {
           </SettingRow>
         </Section>
 
-        {/* Section 6: Tabs */}
+        {/* Section 7: Tabs */}
         <Section title="Tabs">
           <SettingRow
             label="Default tab"
@@ -584,7 +584,7 @@ export default function SettingsPage() {
           </SettingRow>
         </Section>
 
-        {/* Section 7: Data */}
+        {/* Section 8: Data */}
         <Section title="Data">
           {/* Clear cache */}
           <SettingRow

src/app/components/shared/UserAvatarBadge.tsx

@@ -1,5 +1,15 @@
 import { createMemo, For, Show } from "solid-js";
 
+export function buildSurfacedByUsers(
+  surfacedBy: string[] | undefined,
+  trackedUserMap: Map<string, { login: string; avatarUrl: string }>,
+): { login: string; avatarUrl: string }[] {
+  return (surfacedBy ?? []).flatMap((login) => {
+    const u = trackedUserMap.get(login);
+    return u ? [{ login: u.login, avatarUrl: u.avatarUrl }] : [];
+  });
+}
+
 interface UserAvatarBadgeProps {
   users: { login: string; avatarUrl: string }[];
   currentUserLogin: string;