fix: Address second code review findings (test isolation, frontend type safety)

frontend/src/services/auth.ts

@@ -1,4 +1,5 @@
 import api from "./api"
+import type { Theme } from "@/components/theme-provider"
 
 export interface AuthResponse {
   access_token: string
@@ -9,7 +10,7 @@ export interface UserResponse {
   id: string
   email: string
   display_name?: string
-  theme_preference: string
+  theme_preference: Theme
 }
 
 export const AuthService = {
@@ -51,7 +52,7 @@ export const AuthService = {
     await api.post("/auth/logout")
   },
 
-  async updateTheme(theme: string): Promise<UserResponse> {
+  async updateTheme(theme: Theme): Promise<UserResponse> {
     const response = await api.patch<UserResponse>("/auth/theme", { theme })
     return response.data
   },