Close the residual gaps the 2026-09-18 audit left open

Re-checked every item of the audit's own outcome section against the tree.
Most held, but five items marked fixed had residual gaps — one of them a
live IDOR — and the deferred list was untouched.

Security:
- Analytics IDOR: /api/analytics/{ws}/overview and /projection took
  child_id as an unchecked query param, and get_overview called
  get_days_left_at_age_4 without workspace_id, so the ownership guard
  never ran. Any member could read another workspace's child projection.
  Fixed at both layers.
- Scraper: session ids no longer logged at INFO; a persist-callback
  failure's raw exception text and the FK maintenance banner's scraped
  text no longer reach the poll client.
- Email is now case-normalised at the API boundary, with migration 009
  lowercasing existing rows (aborts naming colliding rows rather than
  failing opaquely on the UNIQUE constraint).

Frontend correctness:
- usePlanProposal/usePlanSync gained the stale-response guard the other
  hooks already had.
- PlanSyncProvider no longer fires POST /plan/sync before auth resolves
  off a blindly-read localStorage workspaceId.
- Busy flags are cleared unconditionally across all 16 useLatestRequest
  consumers. setBusy(true) was unconditional while the clear was guarded
  by isCurrent, so a superseded call stranded its flag forever — under
  StrictMode this hung every in-app navigation behind the PageSkeleton.
  isCurrent decides which response's data wins, never whether a call
  releases the flag it raised.

Performance:
- Calendar no longer blanks on a mutation, and a multi-day save issues N
  writes plus one background refetch instead of 2N requests.
- take_pl_on_red_days moved onto GET /auth/context, dropping a redundant
  GET /workspace/:id from every cold load.

CI and repo hygiene: least-privilege permissions block, actions pinned to
commit SHAs, npm ci, uv sync --locked, failure-only artifact upload,
dependabot; dead frontend/out.js removed; CSP added to the nginx template
(repeated into the location blocks that set their own add_header, since
nginx does not merge them across levels).

Left deferred by decision: refresh-token revocation, the phase-2 contract
change, M4, M5, L2, and H12's cross-route cache. Details and the smaller
follow-ups browser verification turned up are in the audit report.

Backend 901 passed, coverage 92%. Frontend 1322 tests, coverage
98.17/94.79/92.14/98.17.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PngVF38MLpdkgXcByKfdW6

backend/app/routers/analytics.py

@@ -44,7 +44,9 @@ async def get_overview(
     pd_repo: PersonalDataRepositoryDep,
     workspace_repo: WorkspaceRepositoryDep,
     vacation_repo: VacationDaysRepositoryDep,
+    scope: WorkspaceScopeDep,
 ) -> WorkspaceOverviewResponse:
+    await scope.check_child(child_id)
     service = _make_service(
         leave_repo, planned_repo, child_repo, pd_repo, workspace_repo, vacation_repo
     )
@@ -65,7 +67,9 @@ async def get_projection(
     pd_repo: PersonalDataRepositoryDep,
     workspace_repo: WorkspaceRepositoryDep,
     vacation_repo: VacationDaysRepositoryDep,
+    scope: WorkspaceScopeDep,
 ) -> WorkspaceOverviewResponse:
+    await scope.check_child(child_id)
     service = _make_service(
         leave_repo, planned_repo, child_repo, pd_repo, workspace_repo, vacation_repo
     )

backend/app/routers/auth.py

@@ -10,6 +10,7 @@ from app.dependencies import (
     ChildRepositoryDep,
     CurrentUserDep,
     PersonalDataRepositoryDep,
+    WorkspaceRepositoryDep,
 )
 from app.rate_limit import limiter
 from app.models.auth import LoginRequest, RegisterRequest, TokenResponse, UserMeResponse
@@ -105,6 +106,11 @@ class _UserContext(BaseModel):
     workspace_id: str
     parent_name: str
     children: list[_ChildContext]
+    # Mirrors `WorkspaceResponse.take_pl_on_red_days` — included here so the
+    # frontend's cold-load `refreshContext()` can build its `workspace`
+    # state from this response alone, without a follow-up `GET
+    # /workspace/:id` (see AGENTS.md H12 step 1).
+    take_pl_on_red_days: bool
 
 
 @router.get("/context", response_model=_UserContext)
@@ -112,12 +118,16 @@ async def get_context(
     current_user: CurrentUserDep,
     pd_repo: PersonalDataRepositoryDep,
     child_repo: ChildRepositoryDep,
+    ws_repo: WorkspaceRepositoryDep,
 ) -> _UserContext:
     """Return workspace + children for the current user. Used by the dev harness."""
     pd = await pd_repo.get_by_id(current_user.personal_data_uuid)
     if pd is None:
         raise HTTPException(status.HTTP_422_UNPROCESSABLE_ENTITY, "No parent profile found")
     children = await child_repo.list_by_workspace(pd.workspace_id)
+    workspace = await ws_repo.get_by_id(pd.workspace_id)
+    if workspace is None:
+        raise HTTPException(status.HTTP_422_UNPROCESSABLE_ENTITY, "No workspace found")
     return _UserContext(
         personal_data_uuid=str(pd.uuid),
         workspace_id=str(pd.workspace_id),
@@ -125,6 +135,7 @@ async def get_context(
         children=[
             _ChildContext(id=str(c.id), name=c.name, birth_date=str(c.birth_date)) for c in children
         ],
+        take_pl_on_red_days=workspace.take_pl_on_red_days,
     )