- scripts/screenshots.py + scripts/Dockerfile.shots: playwright-in-compose
runner, 7 demo shots against the seeded stack (DinD-safe, output volume)
- docker-compose.yml: api + web services (nginx SPA + /api proxy-less via
build-arg VITE_API_BASE), shots service with volume output
- apps/api: add CORSMiddleware (SPA origin web:80 could not read api:8000),
batch scoring now refuses to rewrite applications beyond
discovered/scored (kanban page load previously reset sent/interviewing
to scored), prompt-aware cv_tailor mock so demo passes hallucination
guard, hallucination-guard tests repointed to monkeypatched run_task
- apps/web: Applications kanban batches only unscored applications, red
flag display falls back to stored rationale
- 159 api tests + 14 web tests green after fixes
