~anthropic/claude-sonnet-latest → B (6:4)

Side B fixes genuine crashing bugs in test infrastructure: `str/split` called with a plain string instead of a regex (throws ClassCastException), and `.getInputStream`/`-1` misuse on HttpExchange (wrong API, breaks POST body reads), plus nil-safety for token/state — these were actually breaking the OAuth E2E flow entirely. Side A is mostly UI polish (vote-count badges, HUD unpin button) with reasonable but lower-stakes value, since it doesn't fix a broken core mechanism but refines an already-working feature.