test: update tests for security fixes (origin validation, streaming state)

- archyIntegration: expect window.location.origin instead of '*' for
  postMessage calls (matches FIX-009 origin restriction)
- useAI: fix flaky isStreaming assertion to account for background
  fetch calls (refreshWavlakeCatalog) captured before streaming starts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/src/__tests__/archyIntegration.test.ts

@@ -55,7 +55,7 @@ describe('archyBridge: postMessage protocol', () => {
     archyBridge.init()
     expect(window.parent.postMessage).toHaveBeenCalledWith(
       { type: 'ready' },
-      '*',
+      window.location.origin,
     )
     archyBridge.destroy()
   })
@@ -72,7 +72,7 @@ describe('archyBridge: postMessage protocol', () => {
         type: 'context:request',
         category: 'apps',
       }),
-      '*',
+      window.location.origin,
     )
 
     archyBridge.destroy()
@@ -91,7 +91,7 @@ describe('archyBridge: postMessage protocol', () => {
         action: 'open-app',
         params: { appId: 'mempool' },
       }),
-      '*',
+      window.location.origin,
     )
 
     archyBridge.destroy()
@@ -104,7 +104,7 @@ describe('archyBridge: postMessage protocol', () => {
 
     expect(window.parent.postMessage).toHaveBeenCalledWith(
       { type: 'theme:request' },
-      '*',
+      window.location.origin,
     )
     archyBridge.destroy()
   })

packages/app/src/__tests__/useAI.test.ts

@@ -223,8 +223,9 @@ describe('useAI', () => {
       expect(chatStore.isStreaming).toBe(false)
       await sendMessage('hi')
       expect(chatStore.isStreaming).toBe(false)
-      // During the fetch call, isStreaming should have been true
-      expect(streamingStates[0]).toBe(true)
+      // During the streaming fetch call, isStreaming should have been true
+      // (earlier non-streaming fetches like refreshWavlakeCatalog may also be captured)
+      expect(streamingStates.some(s => s === true)).toBe(true)
     })
 
     it('handles stream errors gracefully', async () => {