P15 Upstream browser and authentication resilience

[edithatogo]

Objective

Make Substack authentication and read-only API access resilient to upstream login-flow, anti-bot, and Cloudflare challenge changes without weakening mutation safety.

Scope

• Playwright storage-state capture from a dedicated local profile
• typed 403/challenge fallback guidance
• opt-in browser-assisted retry for GET/read probes only
• no automatic write replay or committed session state

[edithatogo]

Implementation receipt: PR #470 was squash-merged after all available non-conditional checks passed, including Quality, CodeQL, strict TypeScript, dependency declaration strictness, production audit and secret scan, SBOM, Node 20/22/24 compatibility, smoke, deterministic assurance, Codecov patch coverage, and mutation testing. No actionable PR comments or reviews remained. The implementation detects 403/Cloudflare challenges, keeps write operations fail-closed, supports an explicit one-shot Playwright-assisted retry for eligible read-only requests, and adds secure ignored Playwright storage-state capture through local login and auth refresh-state. No credential or live session was captured during implementation. Remaining activation evidence requires the maintainer's real tester profile and any interactive challenge completion, so this parent issue remains open as an external credential gate.

[edithatogo]

Closed as completed during the T17-01 canonical hierarchy reconciliation; implementation evidence remains in the merged track history.

[edithatogo]

Reopened by programme reconciliation: implementation is merged, but real-profile storage-state and challenge/fallback evidence remain open in #533.