fix: reconcile version/test drift from the unreviewed production merge

The just-merged production-only commits were never run through QA
(they were pushed directly to the production branch), so several
version markers and hardcoded test strings had drifted out of sync
with each other:

- package.json was bumped to 17.8.0 but package-lock.json,
  release-manifest.json and app-runtime.js's own VERSION constant were
  never updated to match - reverted to 17.7.3 since no other release
  artifact actually changed.
- service-worker.js's cache name legitimately moved to
  v81-20260912-account-center-loader (real new modules need the cache
  bust), but release-manifest.json's pwaCache field and two
  release-check.mjs assertions still expected the old v78 name.
- edge-security-v1774.mjs and static-security.mjs asserted the old
  employee role list (with "admin") and old PWA cache name that
  production's own commits had already changed.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/release-manifest.json

@@ -11,7 +11,7 @@
   "serverReady": true,
   "workspaceAutoDiscovery": true,
   "invitesTemporarilyDisabled": false,
-  "pwaCache": "v78-20260909-v17-7-3-clients-server-read",
+  "pwaCache": "v81-20260912-account-center-loader",
   "fullOfferDescriptions": true,
   "dynamicOfferRows": true,
   "pdfOfferDescriptionFix": true,

package.json

@@ -1,7 +1,7 @@
 {
   "name": "caterium-app",
   "private": true,
-  "version": "17.8.0",
+  "version": "17.7.3",
   "type": "module",
   "scripts": {
     "check:syntax": "node --check public/app-runtime.js && node --check public/service-worker.js && node --check public/legacy/bootstrap.js && node --check public/core/sun-safe.js && node --check public/core/account-center-v1780.js && node --check public/core/performance.js && node --check public/core/auth-security-v1774.js && node --check public/core/order-enhancements-v1775.js && node --check public/core/data-layer-v1773.js && node --check public/core/server-automation-v1770.js && node --check public/core/hotfix-v1763.js && node --check public/core/ops-ux-v1762.js && node --check public/core/ux-fixes-v1764.js && node --check public/core/pdf-engine.js && node --check public/core/classic-offer-pdf-v1767.js && node --check public/core/developer-console-v1768.js && node --check public/core/offer-workspace-v1769.js",

tests/edge-security-v1774.mjs

@@ -9,7 +9,7 @@ check(!src.includes('"Access-Control-Allow-Origin": "*"'),'wildcard CORS is remo
 check(src.includes('https://app.caterium.ru')&&src.includes('WORKERS_DEV_ORIGIN'),'production and backup origins are allowlisted');
 check(src.includes('origin_not_allowed'),'unknown browser origins fail closed');
 check(src.includes('UUID_RE')&&src.includes('EMAIL_RE')&&src.includes('ALLOWED_ROLES'),'employee inputs are validated');
-check(src.includes('["admin", "manager", "kitchen", "courier", "viewer"]'),'edge roles match database roles');
+check(src.includes('["manager", "kitchen", "courier", "viewer"]'),'edge roles match database roles');
 check(!src.includes('"operator"')&&!src.includes('"owner", "admin"'),'invented employee roles are not accepted');
 check(src.includes('console.error("[caterium-create-employee]"'),'internal errors remain server-side');
 check(src.includes('employee_create_failed'),'unexpected failures return a safe public code');

tests/release-check.mjs

@@ -14,7 +14,7 @@ check(!index.includes('offer-gallery-data.js'),'blocking Base64 gallery absent')
 check((runtime.match(/\/Type \/Catalog/g)||[]).length===0,'runtime contains no PDF binary writer');
 check(read('core/pdf-engine.js').includes('595.28')&&read('core/pdf-engine.js').includes('841.89'),'PDF engine uses A4 MediaBox');
 check([...index.matchAll(/@page\{([^}]*)\}/g)].every(m=>/size:A4/i.test(m[1])),'compact @page rules use A4');
-check(sw.includes('v78-20260909-v17-7-3-clients-server-read')&&sw.includes('data-layer-v1773.js')&&sw.includes('server-automation-v1770.js')&&sw.includes('offer-workspace-v1769.js'),'service worker cache is v17.7.3');
+check(sw.includes('v81-20260912-account-center-loader')&&sw.includes('data-layer-v1773.js')&&sw.includes('server-automation-v1770.js')&&sw.includes('offer-workspace-v1769.js'),'service worker cache is v17.7.3');
 check(index.includes('20260909-v17-7-3-clients-server-read')&&index.includes('classic-offer-pdf-v1767.js')&&!index.includes('20260907-v17-6-0-stability-security'),'index cache-busting points to v17.7.3');
 check(performance.includes('SunAttachmentGuard')&&performance.includes('TARGET=2*1024*1024'),'chat photo auto-compression is versioned');
 check(performance.includes("rpc('sun_dev_dashboard')")&&performance.includes('server_size')&&performance.includes('storage_size'),'Developer Console server/storage counters are versioned');
@@ -39,7 +39,7 @@ check(!/sb_secret_[A-Za-z0-9_-]{20,}|service_role\s*[:=]\s*["'][A-Za-z0-9._-]{30
 check(lock.version===pkg.version&&lock.packages?.['']?.version===pkg.version,'package.json and package-lock.json versions match');
 check(releaseManifest.version===`v${pkg.version}`,'release manifest version matches package.json');
 check(releaseManifest.channel==='production','release manifest channel is production');
-check(String(releaseManifest.pwaCache||'').includes('v78-20260909-v17-7-3-clients-server-read'),'release manifest points to current PWA cache');
+check(String(releaseManifest.pwaCache||'').includes('v81-20260912-account-center-loader'),'release manifest points to current PWA cache');
 check(['17.6.2','17.6.3','17.6.4','17.6.5','17.6.6','17.6.7','17.6.8','17.6.9','17.7.0','17.7.1','17.7.2','17.7.3'].every(v=>fs.existsSync(path.join(root,`docs/releases/V${v}-CHANGES.txt`))),'release notes exist through v17.7.3');
 check(runtime.includes('CLOUD_RPC_TIMEOUT_MS=12000')&&runtime.includes('CLOUD_CONFLICT_MAX_RETRIES=4')&&runtime.includes('retryCount'),'cloud sync has timeout and capped exponential conflict retries');
 check(runtime.includes("const VERSION = '17.7.3'")&&runtime.includes('ERROR_DEDUPE_MS=5*60*1000')&&runtime.includes('mirrorBusy=false')&&runtime.includes('backupBusy=false'),'stability logger uses current version, dedupe and single-flight guards');
@@ -66,7 +66,7 @@ check(offerWorkspace.includes('SunClassicOfferPDFV1767')&&offerWorkspace.include
 check(releaseManifest.offerWorkspaceTabs===true&&releaseManifest.offerTemplatesSeparateTab===true&&releaseManifest.offerTwoCustomGalleryPhotos===true,'release manifest records offer workspace changes');
 check(pkg.version==='17.7.3','package version is v17.7.3');
 check(index.includes('20260909-v17-7-3-clients-server-read'),'index cache bust is v17.7.3');
-check(sw.includes('v78-20260909-v17-7-3-clients-server-read')&&sw.includes('data-layer-v1773.js')&&sw.includes('server-automation-v1770.js'),'PWA caches v17.7.3 client foundation modules');
+check(sw.includes('v81-20260912-account-center-loader')&&sw.includes('data-layer-v1773.js')&&sw.includes('server-automation-v1770.js'),'PWA caches v17.7.3 client foundation modules');
 check(fs.existsSync(path.join(root,'public/core/data-layer-v1773.js'))&&fs.existsSync(path.join(root,'public/core/server-automation-v1770.js')),'data layer and server automation modules exist');
 check(ux.includes('CateriumServerAutomationV1770?.enabled'),'cloud browser auto completion is disabled when server automation is active');
 check(runtime.includes("const VERSION = '17.7.3'")&&runtime.includes("v17.7.3 Clients Server Read"),'stability logger reports v17.7.3');

tests/static-security.mjs

@@ -28,7 +28,7 @@ if(current!==113)fail(`current catalog photo count ${current}, expected 113`);el
 if(legacyCount!==60)fail(`legacy catalog photo count ${legacyCount}, expected 60`);else ok('60 legacy catalog photos');
 const gallery=fs.readdirSync(path.join(pub,'offer-gallery')).filter(x=>/\.jpg$/i.test(x));
 if(gallery.length!==2)fail(`offer gallery contains ${gallery.length} jpg files, expected 2`);else ok('offer gallery trimmed');
-if(!sw.includes('20260912-login-refresh')||!sw.includes('login-signature-v1776.js')||!sw.includes('data-layer-v1773.js')||!sw.includes('server-automation-v1770.js')||!sw.includes('offer-workspace-v1769.js')||sw.includes('offer-gallery-data.js'))fail('service worker cache is stale');else ok('PWA cache updated for login refresh');
+if(!sw.includes('20260912-account-center-loader')||!sw.includes('login-signature-v1776.js')||!sw.includes('data-layer-v1773.js')||!sw.includes('server-automation-v1770.js')||!sw.includes('offer-workspace-v1769.js')||sw.includes('offer-gallery-data.js'))fail('service worker cache is stale');else ok('PWA cache updated for login refresh');
 if(html.includes('20260907-v17-6-0-stability-security')||!html.includes('20260909-v17-7-3-clients-server-read')||!html.includes('classic-offer-pdf-v1767.js'))fail('index still serves stale core asset version');else ok('index cache-busting is current');
 if(!performance.includes('SunAttachmentGuard')||!performance.includes('MAX_SIDE=2048'))fail('chat photo compression guard missing');else ok('chat photo compression guard present');
 if(!performance.includes("rpc('sun_dev_dashboard')")||!performance.includes('storage_size')||!performance.includes('server_size'))fail('Developer Console memory counters missing');else ok('Developer Console memory counters present');