chore(ops): deploy checklist + standing dependency guards (Phase 8)

- docs/DEPLOY_CHECKLIST.md: the prod-config items that only lived in
  session notes are now in the repo — TOKEN_ENCRYPTION_KEY (v2:->e2:
  migration), WEBAUTHN_RP_ID/_ORIGIN, simplefin_debug_logging off,
  cdn.sheetjs.com egress, Node-version alignment, TS7 deferral
- renovate.json: weekly grouped non-majors, dashboard-approval majors,
  xlsx (CDN-pinned) excluded, typescript capped <7 until
  typescript-eslint supports it
- .forgejo/workflows/deps-audit.yml: weekly scheduled audit that FAILS
  on high+ prod vulns + prints npm outdated — the durable QA-B0-02 fix
  that works even before Renovate is enabled on the Forgejo instance

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.forgejo/workflows/deps-audit.yml

@@ -0,0 +1,25 @@
+# Weekly dependency guard (QA-B0-02 durable fix): dependency rot must surface
+# as a red scheduled run, not wait for the next manual audit. Fails on any
+# high+ vulnerability in production deps; prints the outdated report either way.
+name: deps-audit
+on:
+  schedule:
+    - cron: '0 11 * * 1' # Mondays 11:00 UTC (~06:00 America/Chicago)
+  workflow_dispatch:
+
+jobs:
+  audit:
+    runs-on: docker
+    container:
+      image: node:22-bookworm
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install (lockfile-exact)
+        run: npm ci
+
+      - name: Audit production deps (fail on high or critical)
+        run: npm audit --omit=dev --audit-level=high
+
+      - name: Outdated report (informational)
+        run: npm outdated || true

docs/DEPLOY_CHECKLIST.md

@@ -0,0 +1,45 @@
+# Production Deploy Checklist
+
+The environment/config items that are **not** enforced by code or CI and must be
+verified on the production instance itself. Each has a boot-time warning or a
+QA-plan pointer; this list is the single place they live (previously they only
+existed in session notes).
+
+## Required environment (production)
+
+| Variable                     | Why                                                                                                                                                                                                                                                                 | Symptom if missing                                            |
+| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------- |
+| `TOKEN_ENCRYPTION_KEY`       | At-rest secrets (SimpleFIN token, SMTP/OIDC secrets, login IP/UA) otherwise fall back to a key stored **inside the database** — anyone with DB/backup read access can decrypt. On first boot with the key set, stored `v2:` ciphertexts migrate to env-keyed `e2:`. | Boot warning: `TOKEN_ENCRYPTION_KEY is not set in production` |
+| `WEBAUTHN_RP_ID`             | Passkeys bind cryptographically to this hostname; the `localhost` default silently breaks all passkey sign-ins behind a real domain. Bare hostname, no scheme/port (e.g. `bills.example.com`). Changing it later invalidates registered keys.                       | Boot warning: `WEBAUTHN_RP_ID is not set in production`       |
+| `WEBAUTHN_ORIGIN` (optional) | Pin the exact expected origin for WebAuthn ceremonies when the app is served from a non-default origin. When unset, the API origin plus any request origin whose hostname equals the RP ID is accepted.                                                             | Passkey enroll/sign-in fails origin verification              |
+
+## One-time settings (Admin panel / DB)
+
+- [ ] **Turn OFF `simplefin_debug_logging`** on the production instance
+      (Admin → bank sync config). It is a debugging aid; leaving it on logs
+      more sync detail than production needs.
+
+## Build/runtime infrastructure
+
+- [ ] **`cdn.sheetjs.com` egress** — the lockfile pins `xlsx` to the official
+      SheetJS dist tarball (the npm registry line is abandoned with unfixed
+      high CVEs). CI runners and Docker builds must be able to reach it for
+      `npm ci`.
+- [ ] **Node version alignment** — `package.json` engines, the Dockerfile base
+      image, and the CI image must agree (all `node:22` today). Bump all three
+      together.
+- [ ] Volumes/permissions/migrations: handled by `docker-entrypoint.sh`
+      (`chmod 700` data dirs, non-root `bill` user, `RUN_DB_MIGRATIONS=true`)
+      — covered by QA batch B16.
+
+## Standing dependency guard
+
+- `renovate.json` is in the repo — enable Renovate on the Forgejo instance for
+  grouped weekly update PRs.
+- Until then, `.forgejo/workflows/deps-audit.yml` runs weekly: it fails on any
+  high+ vulnerability (`npm audit --omit=dev --audit-level=high`) and prints
+  `npm outdated`, so dependency rot surfaces as a red scheduled run instead of
+  waiting for the next manual audit.
+- Deferred upgrade, tracked: **TypeScript 7** typechecks this codebase clean but
+  `typescript-eslint` (peer `<6.1.0`) cannot parse under it yet — revisit when
+  typescript-eslint ships TS 7 support.

e2e/control-census.spec.js-snapshots/census-analytics-census-linux.txt

@@ -6,7 +6,7 @@ button | Print / Save PDF
 button | Refresh
 button | Reset filters
 button | Search billsCtrl K
-button | Tracker#
+button | Tracker
 input:checkbox | (unnamed)
 input:number | (unnamed)
 link | About
@@ -17,7 +17,7 @@ link | Release Notes
 link | Skip to main content
 select | # months# months# months
 select | # months# months# months# months
-select | All bills<script>alert(#)</script>Adobe Creative CloudAmazon
+select | All billsAdobe Creative CloudAmazon PrimeAMC A-ListApple iCl
 select | All categoriesBeautyCoffeeCredit CardsDining OutEntertainmen
 select | JanuaryFebruaryMarchAprilMayJuneJulyAugustSeptemberOctoberNo
 select | LineArea

e2e/control-census.spec.js-snapshots/census-banking-census-linux.txt

@@ -2,7 +2,7 @@ button | Current theme: Dark. Click to change.
 button | Open Tanstack query devtools
 button | Open user menu
 button | Search billsCtrl K
-button | Tracker#
+button | Tracker
 link | About
 link | Analytics
 link | Bill Tracker

e2e/control-census.spec.js-snapshots/census-bills-census-linux.txt

@@ -1,13 +1,11 @@
 button | #st bucket
 button | #th bucket
-button | <script>alert(#)</script>
 button | AMC A-List
 button | Add Bill
 button | Adobe Creative Cloud
 button | Amazon Prime
 button | Apple iCloud+
 button | Autopay
-button | Big
 button | Cadence
 button | Capital One Quicksilver
 button | Car Insurance
@@ -33,8 +31,6 @@ button | Homeowners Insurance
 button | Inactive
 button | Internet Provider
 button | Mortgage
-button | Move <script>alert(#)</script> down
-button | Move <script>alert(#)</script> up
 button | Move AMC A-List down
 button | Move AMC A-List up
 button | Move Adobe Creative Cloud down
@@ -43,8 +39,6 @@ button | Move Amazon Prime down
 button | Move Amazon Prime up
 button | Move Apple iCloud+ down
 button | Move Apple iCloud+ up
-button | Move Big down
-button | Move Big up
 button | Move Capital One Quicksilver down
 button | Move Capital One Quicksilver up
 button | Move Car Insurance down
@@ -83,8 +77,6 @@ button | Move Student Loan down
 button | Move Student Loan up
 button | Move Trash Service down
 button | Move Trash Service up
-button | Move Zero down
-button | Move Zero up
 button | Netflix
 button | Open Tanstack query devtools
 button | Open user menu
@@ -92,9 +84,8 @@ button | Search & filters# of # shown · no filters
 button | Search billsCtrl K
 button | Spotify
 button | Student Loan
-button | Tracker#
+button | Tracker
 button | Trash Service
-button | Zero
 combobox | Filter by billing schedule
 combobox | Filter by category
 combobox | Use a bill template

e2e/control-census.spec.js-snapshots/census-calendar-census-linux.txt

@@ -7,7 +7,7 @@ button | Refresh calendar
 button | Search billsCtrl K
 button | Subscribe Calendar
 button | Today
-button | Tracker#
+button | Tracker
 button | View #/#/#
 link | About
 link | Analytics

e2e/control-census.spec.js-snapshots/census-categories-census-linux.txt

@@ -52,7 +52,7 @@ button | Rename Subscriptions
 button | Rename Utilities
 button | Search billsCtrl K
 button | Show Empty
-button | Tracker#
+button | Tracker
 input:text | New category name...
 link | About
 link | Analytics

e2e/control-census.spec.js-snapshots/census-data-census-linux.txt

@@ -6,7 +6,7 @@ button | ImportBring in existing data
 button | Open Tanstack query devtools
 button | Open user menu
 button | Search billsCtrl K
-button | Tracker#
+button | Tracker
 button | TransactionsReview & match
 link | About
 link | Analytics

e2e/control-census.spec.js-snapshots/census-health-census-linux.txt

@@ -5,7 +5,7 @@ button | Open Tanstack query devtools
 button | Open user menu
 button | Refresh
 button | Search billsCtrl K
-button | Tracker#
+button | Tracker
 link | About
 link | Analytics
 link | Bill Tracker

e2e/control-census.spec.js-snapshots/census-payoff-census-linux.txt

@@ -7,7 +7,7 @@ button | Print
 button | Required Minimum: help
 button | Search billsCtrl K
 button | Time Savings: help
-button | Tracker#
+button | Tracker
 button | ▲
 button | ▼
 combobox | Capital One Quicksilver$#

e2e/control-census.spec.js-snapshots/census-profile-census-linux.txt

@@ -1,14 +1,14 @@
 button | Add key
 button | Change Password
 button | Current theme: Dark. Click to change.
-button | Last LoginJul # # #:# PMDesktop · Chrome on Linux#
+button | Last LoginJul # # #:# AMDesktop · Chrome on Linux#
 button | Open Tanstack query devtools
 button | Open user menu
 button | Save Privacy Settings
 button | Save Profile
 button | Search billsCtrl K
 button | Set up
-button | Tracker#
+button | Tracker
 input:password | (unnamed)
 input:text | Display name
 link | About

e2e/control-census.spec.js-snapshots/census-settings-census-linux.txt

@@ -15,7 +15,7 @@ button | Search billsCtrl K
 button | Send test
 button | System
 button | Theme: help
-button | Tracker#
+button | Tracker
 combobox | MM/DD/YYYY
 combobox | Sunday
 combobox | Tracker

e2e/control-census.spec.js-snapshots/census-snowball-census-linux.txt

@@ -26,7 +26,7 @@ button | Restore Ramsey Order
 button | Save Order
 button | Search billsCtrl K
 button | Toggle plan details
-button | Tracker#
+button | Tracker
 input:number | #
 link | About
 link | Analytics

e2e/control-census.spec.js-snapshots/census-spending-census-linux.txt

@@ -17,7 +17,7 @@ button | Previous month
 button | Search billsCtrl K
 button | Shopping
 button | Shopping$# transactionavg $#/mo$# left
-button | Tracker#
+button | Tracker
 button | Uncategorized
 button | Uncategorized$# transaction
 button | View

e2e/control-census.spec.js-snapshots/census-subscriptions-census-linux.txt

@@ -40,7 +40,7 @@ button | Search subscriptions# of # shown · no filters
 button | Search transactionsall bank transactions · no filters
 button | Spotify
 button | Track Subscription
-button | Tracker#
+button | Tracker
 button | View recommendation details
 input:search | Search by merchant, description, or payee…
 input:search | Search recommendations…

e2e/control-census.spec.js-snapshots/census-summary-census-linux.txt

@@ -1,15 +1,11 @@
 button | Current theme: Dark. Click to change.
 button | Edit
-button | Move <script>alert(#)</script> down
-button | Move <script>alert(#)</script> up
 button | Move AMC A-List down
 button | Move AMC A-List up
 button | Move Adobe Creative Cloud down
 button | Move Adobe Creative Cloud up
 button | Move Apple iCloud+ down
 button | Move Apple iCloud+ up
-button | Move Big down
-button | Move Big up
 button | Move Capital One Quicksilver down
 button | Move Capital One Quicksilver up
 button | Move Car Insurance down
@@ -46,8 +42,6 @@ button | Move Student Loan down
 button | Move Student Loan up
 button | Move Trash Service down
 button | Move Trash Service up
-button | Move Zero down
-button | Move Zero up
 button | Next month
 button | Open Tanstack query devtools
 button | Open user menu
@@ -55,7 +49,7 @@ button | Previous month
 button | Print / PDF
 button | Search billsCtrl K
 button | Today
-button | Tracker#
+button | Tracker
 link | About
 link | Analytics
 link | Bill Tracker

e2e/control-census.spec.js-snapshots/census-tracker-census-linux.txt

@@ -12,11 +12,9 @@ button | Current theme: Dark. Click to change.
 button | Debt
 button | Due
 button | Due Soon, click to mark paid
-button | Edit <script>alert(#)</script>
 button | Edit AMC A-List
 button | Edit Adobe Creative Cloud
 button | Edit Apple iCloud+
-button | Edit Big
 button | Edit Capital One Quicksilver
 button | Edit Car Insurance
 button | Edit Car Payment
@@ -35,25 +33,18 @@ button | Edit Netflix
 button | Edit Spotify
 button | Edit Student Loan
 button | Edit Trash Service
-button | Edit Zero
 button | Edit monthly starting amounts
 button | Expected
 button | Export or print this month
 button | Hide
-button | Hide overdue panel
 button | Keyboard shortcuts
 button | Last Month
-button | Late, click to mark paid
-button | Move <script>alert(#)</script> down
-button | Move <script>alert(#)</script> up
 button | Move AMC A-List down
 button | Move AMC A-List up
 button | Move Adobe Creative Cloud down
 button | Move Adobe Creative Cloud up
 button | Move Apple iCloud+ down
 button | Move Apple iCloud+ up
-button | Move Big down
-button | Move Big up
 button | Move Capital One Quicksilver down
 button | Move Capital One Quicksilver up
 button | Move Car Insurance down
@@ -90,8 +81,6 @@ button | Move Student Loan down
 button | Move Student Loan up
 button | Move Trash Service down
 button | Move Trash Service up
-button | Move Zero down
-button | Move Zero up
 button | Next month
 button | Open Tanstack query devtools
 button | Open calendar for this month
@@ -101,25 +90,19 @@ button | Paid
 button | Paid Date
 button | Paid, click to mark unpaid
 button | Pay all due (#)
-button | Pay now
 button | Pin Due
 button | Previous month
-button | Review overdue bills# items ready for pay, skip, or snooze$#
 button | Search & sort# of # shown · no filters
 button | Search billsCtrl K
-button | Skip
-button | Snooze
 button | Status
 button | Today
-button | Tracker#
+button | Tracker
 button | Unpaid
 button | Upcoming, click to mark paid
 button | —
-checkbox | Select <script>alert(#)</script>
 checkbox | Select AMC A-List
 checkbox | Select Adobe Creative Cloud
 checkbox | Select Apple iCloud+
-checkbox | Select Big
 checkbox | Select Capital One Quicksilver
 checkbox | Select Car Insurance
 checkbox | Select Car Payment
@@ -138,13 +121,10 @@ checkbox | Select Netflix
 checkbox | Select Spotify
 checkbox | Select Student Loan
 checkbox | Select Trash Service
-checkbox | Select Zero
 combobox | Filter by billing schedule
 combobox | Filter by category
 combobox | Sort by
-input:number | <script>alert(#)</script> payment amount
 input:number | Apple iCloud+ payment amount
-input:number | Big payment amount
 input:number | Capital One Quicksilver payment amount
 input:number | Car Payment payment amount
 input:number | Cell Phone payment amount

playwright.config.js

@@ -51,6 +51,8 @@ module.exports = defineConfig({
         // probe-only: enables WebAuthn for the seeded user mid-test, which would
         // race the password logins in these parallel UI projects
         /webauthn\.probe\.spec\.js/,
+        // census-project-only: snapshots depend on pristine seed data
+        /control-census\.spec\.js/,
       ],
     },
     {
@@ -64,6 +66,8 @@ module.exports = defineConfig({
         // probe-only: enables WebAuthn for the seeded user mid-test, which would
         // race the password logins in these parallel UI projects
         /webauthn\.probe\.spec\.js/,
+        // census-project-only: snapshots depend on pristine seed data
+        /control-census\.spec\.js/,
       ],
     },
     // Find-mode diagnostics (adversarial API probe + authenticated a11y scan).
@@ -71,12 +75,23 @@ module.exports = defineConfig({
     // so open findings here don't turn the default suite red. Run on demand:
     // `npm run test:e2e:probe`. Fold a spec into the default projects once its
     // findings are fixed (it becomes a passing regression guard).
+    // Control census (Appendix E automation): read-only snapshots of every
+    // page's interactive controls. Own project ordered BEFORE the probe so the
+    // snapshots always see pristine seed data — api.probe/webauthn mutate the
+    // scratch DB (adversarial bills, passkey enrollment) and would otherwise
+    // make the baselines depend on spec ordering.
     {
-      name: 'probe',
-      testMatch: /(api\.probe|a11y\.authed|webauthn\.probe|control-census)\.spec\.js/,
+      name: 'census',
+      testMatch: /control-census\.spec\.js/,
       use: { ...devices['Desktop Chrome'] },
       dependencies: ['setup'],
     },
+    {
+      name: 'probe',
+      testMatch: /(api\.probe|a11y\.authed|webauthn\.probe)\.spec\.js/,
+      use: { ...devices['Desktop Chrome'] },
+      dependencies: ['setup', 'census'],
+    },
     // Cross-browser (WebAuthn/Select behavior differs) — enable when ready:
     // { name: 'firefox', use: { ...devices['Desktop Firefox'] }, dependencies: ['setup'], testIgnore: /auth\.setup\.js/ },
     // { name: 'webkit',  use: { ...devices['Desktop Safari'] },  dependencies: ['setup'], testIgnore: /auth\.setup\.js/ },

renovate.json

@@ -0,0 +1,32 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"],
+  "timezone": "America/Chicago",
+  "schedule": ["before 6am on monday"],
+  "labels": ["dependencies"],
+  "rangeStrategy": "bump",
+  "packageRules": [
+    {
+      "description": "Group all non-major updates into one weekly PR",
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "non-major dependencies"
+    },
+    {
+      "description": "Majors stay separate — each needs its own verification pass (see docs/QA_PLAN.md B0 dependency recon)",
+      "matchUpdateTypes": ["major"],
+      "dependencyDashboardApproval": true
+    },
+    {
+      "description": "xlsx is pinned to the official SheetJS CDN tarball (npm line is abandoned with unfixed CVEs) — do not touch",
+      "matchPackageNames": ["xlsx"],
+      "enabled": false
+    },
+    {
+      "description": "typescript is capped at 6.x until typescript-eslint supports TS 7 (peer <6.1.0)",
+      "matchPackageNames": ["typescript"],
+      "allowedVersions": "<7.0.0"
+    }
+  ],
+  "vulnerabilityAlerts": { "enabled": true },
+  "osvVulnerabilityAlerts": true
+}