gate live-upstream browser e2e behind ANIWEB_LIVE_TESTS=1: provider rotation/takedowns were turning the suite red for non-regressions; default suite is hermetic (33 tests) again

README.md

@@ -131,17 +131,22 @@ SPEC.md   design + the verified anidb.app data flow
   state flips to `server.log`; `GET /api/cdn` (public) returns the
   latest throughput + ~1h history. Use it to check if "playback
   broken" is the CDN again.
-- The front-end is version-pinned: bump `?v=N` on `app.js`/`style.css`
-  in `index.html` on every static change — phones/proxies otherwise
-  serve stale JS (index.html itself is `no-store`).
+- The front-end is version-pinned: the server injects the git SHA as the
+  `?v=` cache-bust on `app.js`/`style.css` at startup (index.html itself
+  is `no-store`), so a restart is a cache bump — nothing to hand-bump.
+- Mutations need the `X-Aniweb: 1` header (CSRF: cross-site form POSTs
+  can't set it), `/login` POST included — forced-login is dead.
+- Login throttling (server/auth.py): per-username 5 fails -> 15 min lock,
+  plus a per-source-IP budget; both sliding windows, in-memory.
 - Playback failures self-report: the client posts a step timeline +
   capability fingerprint to `/api/events` (see the `events` table),
   so a broken browser is diagnosable from the server.
-- `.venv/bin/pytest tests/ -q` runs the full test suite against a
+- `.venv/bin/pytest tests/ -q` runs the test suite against a
   throwaway server (:8399, temp data dir — never touches the real
-  data). The API tests use stdlib only; the browser tests need
-  playwright (`uv pip install playwright && playwright install
-  chromium`) and are skipped if absent.
+  data). The default suite (API + auth + dispatch tests) is hermetic
+  and deterministic; the Playwright browser tests scrape and play LIVE
+  upstream content, so they are opt-in: `ANIWEB_LIVE_TESTS=1
+  .venv/bin/pytest tests/ -q` (needs playwright chromium installed).
 - Episode titles are not available: anidb's episode API only returns
   `{id, number, number2, filler}`. Adding titles needs a free
   MyAnimeList API key.