test: automated responsive-layout harness (closes #13)

Verifies the mobile layout from #5 with a real browser engine instead of
by hand on a phone. make frontend-viewport-test builds dist/, serves it
from the same digest-pinned nginx image and the same nginx.conf the
shipping container uses, and drives a digest-pinned headless Chrome
against it over CDP.

Viewport widths are derived from the app's own CSS rather than from a
list of phone models: the @media conditions in src/styles.css and any
Tailwind responsive prefixes in the markup are parsed, and each
breakpoint is tested one pixel below, exactly on, and one pixel above.
max-width: 768px matches at 768, and a generic 375px test sails past
that boundary entirely. Four anchor viewports are added with stated
reasons: a 320px floor, a desktop baseline, and two phone-landscape
sizes straddling the breakpoint.

Assertions are on computed layout, not screenshots: horizontal overflow,
elements past the viewport edge, clipped text (deliberate ellipsis
truncation excluded), 44x44 minimum tap targets, and genuine reflow of
the host rows checked on both flex-direction and geometry. Probing and
gateway detection are asserted to still run at narrow widths, since the
early-return mobile path rejected in #8 is what would silently regress.
Screenshots are written to tmp/viewport/ as artifacts alongside the
results, not as the evidence.

puppeteer-core rather than playwright: it is the one variant of either
that never downloads or bundles a browser, so the browser stays a
digest-pinned image and the npm side is pinned by yarn.lock integrity.

The browser container runs on an --internal docker network with no route
off the host; the harness answers the app's latency probes itself from a
fixed delay table so the rows render a realistic spread of value widths.

Kept out of make check: it needs Docker and takes minutes, where make
test has to stay under 20 seconds.

Every check guards its own presence, so none can pass against a page it
is not measuring. The tap-target check in particular would otherwise be
inert: an empty undersized set means both "all controls are big enough"
and "the selectors have gone stale", and the size comparison alone
cannot tell those apart. Each selector therefore declares the minimum
number of visible instances the page must contain, per selector rather
than in total, so one stale selector out of four fails rather than only
all four at once.

Layout expectation is likewise refused rather than guessed. A width is
narrow when a max-width block matches (desktop-first, what the app does
today) or, for a min-width-only mobile-first set, when it falls below
every breakpoint; a set mixing both cannot be resolved from the
conditions alone, because which block owns the reflow is a property of
the rules inside it, so the run fails with an explanation instead of
testing the right widths against the wrong expectation.

The harness was observed failing before being trusted, four times: a
planted 900px fixed-width element in a host row; the mobile reflow rule
neutered; the tap-target threshold lowered so nothing was undersized and
.pin-btn then renamed, which took the check from 8/8 green at every
touch viewport to failing at all six, naming the stale selector; and a
second media block added so the breakpoint set mixed max and min, which
aborted the run. All reverted.

Written against a layout it found two real defects in, filed as #42
(horizontal overflow at 320px) and #43 (tap targets below 44x44). Both
have since landed, so on this base the harness reports 55/55 across all
seven viewports.

TODO.md

@@ -39,6 +39,14 @@ files, so merging it also closes most compliance gaps.
   ignored repo-wide, not just under `backend/`. Excluding `.git` from
   `.dockerignore` stays deferred: both images read git metadata at build time
   (`COPY .git` in `Dockerfile.backend`, `git rev-parse` in `vite.config.js`)
+- 2026-08-09: automated responsive-layout harness
+  (`make frontend-viewport-test`): digest-pinned headless Chrome driven over CDP
+  against the built `dist/`, viewport widths derived from the breakpoints in
+  `src/styles.css` ([#13](https://git.eeqj.de/sneak/netwatch/issues/13)). Every
+  check carries a presence guard so none of them can pass against a page it is
+  not actually measuring. Found two real layout defects, filed as
+  [#42](https://git.eeqj.de/sneak/netwatch/issues/42) and
+  [#43](https://git.eeqj.de/sneak/netwatch/issues/43)
 - 2026-07-07 Adopted scripts-to-rule-them-all: `script/` entrypoints, Makefile
   shims, README Entrypoints section
 - 2026-02-27: backend with buffered zstd-compressed report storage; CI workflow
@@ -56,6 +64,9 @@ files, so merging it also closes most compliance gaps.
 
 # Future Steps
 
+- Wire `script/frontend-viewport-test` into CI as its own step (deliberately not
+  part of `make check` today; the decision has real CI-runtime cost and is
+  tracked separately)
 - Compliance top-up as one small commit: add .editorconfig and add the hooks
   target to the Makefile
 - After merge, confirm .gitea/workflows/check.yml is on main and CI is green