docs: align completion plan with final evidence

docs/local-hardening-plan.md

@@ -10,13 +10,13 @@ item below unless the evidence column explicitly describes a local mock.
 | Browser E2E | Manual headed-Chrome scenarios exist; no committed browser suite | A fresh uniquely named Compose project runs two-user urgent help, Activity, moderation, privacy, and error paths; traces are retained on failure; its exact volume is removed |
 | Android UI | Two JVM unit-test files; no `androidTest` source set | Emulator instrumentation covers deep links, permissions, foreground tracking, notification Stop, lifecycle, and network failure |
 | CI and quality | No tracked CI workflow or static/security analysis dependencies | The same containerized gates pass locally and are represented in a validated CI workflow |
-| Localization and accessibility | Completed locally: product copy and custom validation messages are extracted; EN/UK/RU catalogs and localized category descriptions/structured values are implemented | 508 default and 40 error messages are current; RU/UK have no empty/fuzzy entries; 171 backend tests and all 8 browser specs pass, including locale persistence, keyboard, axe, themes, responsive widths, and reconnect |
+| Localization and accessibility | Completed locally: product copy and custom validation messages are extracted; EN/UK/RU catalogs and localized category descriptions/structured values are implemented | 508 default and 40 error messages are current; RU/UK have no empty/fuzzy entries; 174 backend tests and all 30 browser scenarios pass across Chromium, Firefox and WebKit, including locale persistence, keyboard, axe, themes, responsive widths, and reconnect |
 | Database scale | Core discovery/chat/moderation lists call unbounded `Repo.all()` | Cursor-bounded queries pass behavior tests and measured `EXPLAIN ANALYZE` checks on an isolated generated dataset |
 | Load and resilience | Public/readiness/heartbeat k6 profile exists | Authenticated writes, chat, tracking, reconnect, rolling replacement, and worker retry profiles pass without touching staging data |
 | Observability | Completed locally: protected per-process metrics feed a pinned Prometheus/Grafana/Alertmanager profile | All 3 direct web targets are up before/after the drill; a verified replica stop delivers firing and resolved webhooks; Grafana datasource/dashboard and an empty DB-count diff are retained |
 | Backup | Completed locally: a plaintext-free Restic stream is retained in pinned local MinIO | The encrypted repository passes full-data checking and fresh-database restore; corrupted configuration and an interrupted upload fail closed, leave no snapshot, and their temporary buckets are removed |
 | External boundaries | Completed locally: real Assent/Req, Swoosh/gen_smtp, and the provider-neutral push adapter run against an internal protocol mock | Success, rejection, retry, replay, timeout, PKCE/state, one-time-code, and idempotency paths pass without host ports or retained secrets; acceptance/chat product events pass through an ephemeral PostGIS database and two Oban workers |
-| Final regression | 167 Phoenix tests plus reproducible browser and Android device suites | Browser, Android, API, DB, WebSocket, backup, monitoring, failure, cleanup, docs, and clean Git are verified from the final commits |
+| Final regression | 174 Phoenix tests plus reproducible browser and Android device suites | Browser, Android, API, DB, WebSocket, backup, monitoring, failure, cleanup, docs, and clean Git are verified from the final commits |
 
 The goal remains open while any row lacks reproducible local evidence.
 
@@ -59,7 +59,7 @@ The goal remains open while any row lacks reproducible local evidence.
 - The containerized `scripts/quality.sh` gate passes ShellCheck, Hadolint,
   actionlint, all Compose renders, Helm lint, a Trivy scan of tracked source and
   the rendered Kubernetes manifest, compiler/xref/Credo/Sobelow/Dialyzer/Hex
-  checks, 167 Phoenix tests, both npm audits, and Trivy scans of the backup,
+  checks, 174 Phoenix tests, both npm audits, and Trivy scans of the backup,
   MinIO server/client, external-mock, and production release images. It creates
   random one-run database credentials and removes its exact volume, networks,
   images, and source snapshot.
@@ -79,19 +79,19 @@ The goal remains open while any row lacks reproducible local evidence.
 - The isolated three-web/two-worker load profile now uses real password login,
   authenticated LiveView joins, tracking start, HTTP position writes, private
   chat writes, and explicit tracking stop. A measured 30-second run completed
-  all 1,888 authenticated chains and 240 heartbeat sockets with no functional
+  all 1,765 authenticated chains and 240 heartbeat sockets with no functional
   failure, retained no current positions after stop, passed cross-node PubSub
   and readiness, and restored every tracked table count after exact fixture
   cleanup.
 - The same isolated profile now passes deliberate web/worker BEAM crashes,
   sequential replacement of every replica, exact five-node cluster/PubSub
   checks, and an Oban job that records one failure before succeeding on its
-  second attempt. A 758-sample readiness probe observed no final HTTP failure
+  second attempt. A 725-sample readiness probe observed no HTTP failure
   and the probe job/domain fixtures were absent afterward.
 - The project-owned kind cluster also passes a full web/worker rolling restart:
   all four pod UIDs changed, all replacements became Ready with zero restarts,
   the four-node cluster/PubSub probe passed, and database counts were unchanged.
-  The local single-node NodePort needed two reconnect attempts across 362
+  The local single-node NodePort needed two one-retry samples across 395
   ultimately successful samples; this is recorded rather than presented as
   raw transport continuity.
 - The isolated observability profile scrapes all three web containers by direct