Plan: user flows are tested in the browser, W3 keeps server rules

[can3p]

Stacked on #135 (W0); merge that first, then this PR retargets to master.

HTTP end-to-end tests that imitate htmx (sending HX-Request, pinning HX-* response headers) keep passing when an htmx upgrade breaks every page. This reshapes the plan so everything a user does in a page is tested in a real browser.

• W6 becomes the specification of every user flow. It takes over W3's form and action flows (writing, comments, connections, settings, feeds, shares) and gains B7 (log in, log out, sign up, accept an invitation).
  • Reliability rules: assert what the user sees and the database state, never htmx internals; wait only through auto-waiting assertions; no retries in CI; repeated runs before a task is accepted.
  • An htmx inventory (every hx-* attribute, extension, config setting, error handler and HX-* response header in use), each of which a test must exercise through a visible result.
  • Library mutation checks: removing json-enc, head-support or the htmx error handler must fail the suite.
  • The browser CI job runs on Dependabot's npm updates too, and must pass before merging.
• W3 shrinks from 6 tasks to 4: visibility, the guards on every mutating route (login, CSRF, someone else's objects, with the database unchanged), one-shot links, and the API, RSS and uploads through the API. W3 never sends or checks HX-* headers. W3 and W6 together must cover every route.
• W6.B0 starts first after W0. The plan index, R2, WB and the frontend-htmx and wave-run skills are updated to match.

The harness side (the HTTP client no longer imitates htmx) is already in #135.

🤖 Generated with Claude Code

https://claude.ai/code/session_016UQyTX1ww97bDaWMEBtmuE