docs(plan): marcheaza /design-review done (FINDING-004 htmx local)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/main.py

@@ -10,10 +10,12 @@ from __future__ import annotations
 
 from contextlib import asynccontextmanager
 from datetime import datetime, timezone
+from pathlib import Path
 
 from fastapi import FastAPI, Request
 from fastapi.exceptions import RequestValidationError
 from fastapi.responses import JSONResponse, PlainTextResponse
+from fastapi.staticfiles import StaticFiles
 
 from . import __version__
 from .api.v1.router import router as api_v1_router
@@ -46,6 +48,13 @@ async def validation_exception_handler(request: Request, exc: RequestValidationE
     return JSONResponse(status_code=422, content={"detail": cleaned})
 
 
+# Assets servite local (htmx vendorizat), NU din CDN: gateway-ul ruleaza
+# offline (LXC/VPS, Cloudflare Tunnel). Fara asta, dashboard-ul ramane static
+# (zero polling banner/coada) cand unpkg e blocat/inaccesibil. Aceeasi decizie
+# offline-first ca fontul UI (fara dependinta CDN).
+_STATIC_DIR = Path(__file__).resolve().parent / "web" / "static"
+app.mount("/static", StaticFiles(directory=str(_STATIC_DIR)), name="static")
+
 app.include_router(api_v1_router)
 app.include_router(web_router)
 

app/web/templates/base.html

@@ -4,7 +4,7 @@
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>{% block title %}Gateway RAR AUTOPASS{% endblock %}</title>
-  <script src="https://unpkg.com/htmx.org@1.9.12"></script>
+  <script src="/static/htmx.min.js"></script>
   <style>
     :root { --bg:#0f1115; --card:#181b22; --ink:#e6e9ef; --muted:#8b93a7; --line:#262b36;
             --ok:#3ecf8e; --warn:#e6b34a; --err:#e5605e; --accent:#5b8def; }

docs/plans/plan.md

@@ -237,8 +237,10 @@ Nimic din cod nu e scris încă (`app/`, `tools/` nu există). Ordine recomandat
   în editor + motiv pe submission), **RAR indisponibil** (indicator stare RAR derivat din ultimul login < 30h → coada arată
   ultima stare cunoscută local, nu live), banner alertă blocate (poll 15s). Componente: status worker/RAR, editor mapări
   fuzzy, **browser nomenclator**, coadă (poll 10s), **export audit CSV** (`GET /v1/audit/export?status=sent|all&date_from&date_to`,
-  b64Image exclus, coloană `purge_after`). Verify: 5 teste (`tests/test_dashboard.py`) + smoke live. **Rămas: `/design-review`
+  b64Image exclus, coloană `purge_after`). Verify: 5 teste (`tests/test_dashboard.py`) + smoke live.
-  pe UI-ul live** (cosmetic, neblocant).
+- [x] **`/design-review` pe UI-ul live** ✅ 2026-06-15. Regression vs baseline: cele 3 findings prior (ierarhie titluri,
+  font stack, tap targets) încă rezolvate. Nou + fixat: **FINDING-004** — htmx era din CDN (unpkg); gateway-ul rulează
+  offline → vendorizat local (`app/web/static/htmx.min.js` + mount `/static`, commit `b12be3d`). Design score B, AI slop A.
 
 ### De decis ulterior (urmărit, nu blocant)
 - **[P2]** Defer criptare-at-rest + purjare 90z până după primul postPrezentare real reușit? (gold-plating vs. privacy-argument-de-adopție).