test(tlsfingerprint): update expectations to Claude Code CLI default (X25519MLKEM768 + X25519)

backend/internal/pkg/tlsfingerprint/dialer_capture_test.go

@@ -137,7 +137,7 @@ func TestDialerAgainstCaptureServer(t *testing.T) {
 			}
 			effectiveKeyShare := tc.profile.KeyShareGroups
 			if len(effectiveKeyShare) == 0 {
-				effectiveKeyShare = []uint16{29} // X25519
+				effectiveKeyShare = []uint16{4588, 29} // X25519MLKEM768 + X25519 (Claude Code CLI default)
 			}
 			effectivePSKModes := tc.profile.PSKModes
 			if len(effectivePSKModes) == 0 {
@@ -361,8 +361,8 @@ func TestBuildClientHelloSpecNewFields(t *testing.T) {
 				t.Errorf("default versions: got %v, want 2 entries", e.Versions)
 			}
 		case *utls.KeyShareExtension:
-			if len(e.KeyShares) != 1 {
-				t.Errorf("default key shares: got %d, want 1", len(e.KeyShares))
+			if len(e.KeyShares) != 2 {
+				t.Errorf("default key shares: got %d, want 2", len(e.KeyShares))
 			}
 		}
 	}

backend/internal/pkg/tlsfingerprint/dialer_integration_test.go

@@ -88,14 +88,14 @@ func TestJA3Fingerprint(t *testing.T) {
 	t.Logf("JA3 Hash: %s", fpResp.TLS.JA3Hash)
 	t.Logf("JA4: %s", fpResp.TLS.JA4)
 
-	expectedJA3Hash := "44f88fca027f27bab4bb08d4af15f23e"
+	expectedJA3Hash := "048900f5ae64cc2a49a44389a5406191"
 	if fpResp.TLS.JA3Hash == expectedJA3Hash {
 		t.Logf("✓ JA3 hash matches: %s", expectedJA3Hash)
 	} else {
 		t.Errorf("✗ JA3 hash mismatch: got %s, expected %s", fpResp.TLS.JA3Hash, expectedJA3Hash)
 	}
 
-	expectedJA4CipherHash := "_5b57614c22b0_"
+	expectedJA4CipherHash := "_b262b3658495_"
 	if strings.Contains(fpResp.TLS.JA4, expectedJA4CipherHash) {
 		t.Logf("✓ JA4 cipher hash matches: %s", expectedJA4CipherHash)
 	} else {
@@ -119,7 +119,7 @@ func TestAllProfiles(t *testing.T) {
 				Name:         "default_node_v24",
 				EnableGREASE: false,
 			},
-			JA4CipherHash: "5b57614c22b0",
+			JA4CipherHash: "b262b3658495",
 		},
 		{
 			// Linux x64 Node.js v22.17.1 (explicit profile with v22 extensions)