docs(project): update next 16 validation status

Author: rschlaefli

project/2026-06-01-next-16-upgrade-plan.md

@@ -139,7 +139,10 @@ Upgrade KlickerUZH from Next.js 15.5.x to Next.js 16 as the first major dependen
 - 2026-06-03: Playwright login smoke passed for Chromium on a clean reset/seeded database. The full configured Playwright run is still not complete because local Firefox/WebKit Playwright browser binaries are missing; `playwright install firefox webkit` stalled in the downloader after partially downloading Firefox and was terminated.
 - 2026-06-03: Real local test-stack browser screenshots were captured with `npx agent-browser` for PWA login/home, auth delegated-login, manage library, and control course selection. Evidence was added under `project/2026-06-01-next-16-screenshots/`.
 - 2026-06-03: Final local security review found no new high-confidence exploitable issue in the validation fixes. The latest runtime code change is type-only; test helper changes are Cypress-only.
-- 2026-06-03: Residual blockers are now limited to explicit approval for `pnpm audit --audit-level high` dependency-inventory disclosure and repairing the local Playwright Firefox/WebKit browser cache for the full cross-browser smoke.
+- 2026-06-03: Current-head GitHub checks for `6667f0cf7` passed: TypeScript/check, syncpack/check, GraphQL package test, and GitGuardian. Image build jobs remain skipped for this branch as expected.
+- 2026-06-03: `pnpm audit --audit-level high` remains blocked by policy until explicit user approval because it discloses private dependency inventory to npm's advisory endpoint. A renewed approval request was rejected for that reason.
+- 2026-06-03: Full Playwright cross-browser remains blocked by local browser installation state. A second `playwright install firefox webkit` attempt using `PLAYWRIGHT_BROWSERS_PATH=/private/tmp/klicker-next16-pw-browsers` again downloaded Firefox to 100%, then stalled with only a 892 KB partial cache and was terminated.
+- 2026-06-03: Residual blockers are now limited to explicit approval for `pnpm audit --audit-level high` dependency-inventory disclosure and repairing the local Playwright Firefox/WebKit browser installation for the full cross-browser smoke.
 
 ## Follow-Up PRs
 

project/2026-06-01-next-16-upgrade-report.md

@@ -134,7 +134,7 @@ Rollup workspaces: `apps/backend-docker`, `apps/hatchet-worker-general`, `apps/h
 - The Rollup override in `pnpm-workspace.yaml` forces vulnerable `rollup@>=4.0.0 <4.59.0` ranges to `4.59.1`.
 - Shared Next image optimization is stricter than the first implementation attempt: local-IP optimization is allowed only in development and test, not staging.
 - Final local security review on 2026-06-03 found no new high-confidence exploitable issue in the validation fixes. The latest runtime code change is a type-only migration client import alignment; the Cypress helpers and screenshots are test/report artifacts.
-- `pnpm audit --audit-level high` is still not run because npm audit sends dependency inventory to the configured registry. This needs explicit approval before running against the public npm advisory endpoint.
+- `pnpm audit --audit-level high` is still not run because npm audit sends dependency inventory to the configured registry. A 2026-06-03 approval request was rejected by policy due private dependency-inventory disclosure risk; this still needs explicit user approval before running against the public npm advisory endpoint.
 
 ## Verification
 
@@ -162,6 +162,14 @@ Passed:
 - `pnpm --filter @klicker-uzh/office-addin build:office`
 - Focused GraphQL CI-fix smoke: `pnpm --filter @klicker-uzh/graphql exec vitest run test/liveQuizPointCorrections.test.ts` no longer fails with `Cannot find package 'src/...'`; local execution now stops at the expected missing `HATCHET_CLIENT_TOKEN` prerequisite.
 
+Passed on GitHub for current head `6667f0cf7`:
+
+- Check TypeScript types / `check` -> pass
+- Check syncpack conformity / `check` -> pass
+- Test graphql package logic functionalities / `test` -> pass
+- GitGuardian Security Checks -> pass
+- Docker image build jobs -> skipped for this branch, as expected
+
 Browser smoke screenshots against built Next apps:
 
 - Auth: `project/2026-06-01-next-16-screenshots/klicker-next16-auth.png`
@@ -173,7 +181,7 @@ Browser smoke screenshots against built Next apps:
 Blocked or pending:
 
 - `pnpm audit --audit-level high`: pending explicit approval to submit dependency inventory to npm's advisory endpoint.
-- Full configured Playwright cross-browser run: Chromium passed, but Firefox and WebKit failed before app execution because their Playwright browser binaries were missing locally. A `playwright install firefox webkit` attempt downloaded Firefox but then stalled in the browser downloader with only a partial cache, so it was terminated. This is local browser-cache/tooling state, not an observed Klicker app failure.
+- Full configured Playwright cross-browser run: Chromium passed, but Firefox and WebKit failed before app execution because their Playwright browser binaries were missing locally. Two `playwright install firefox webkit` attempts downloaded Firefox to 100% and then stalled in the browser downloader with only a partial cache; the second attempt used `PLAYWRIGHT_BROWSERS_PATH=/private/tmp/klicker-next16-pw-browsers`, remained at 892 KB, and was terminated. This is local browser-cache/tooling state, not an observed Klicker app failure.
 
 Real local test-stack browser verification with `npx agent-browser`:
 
@@ -213,7 +221,7 @@ Context:
 Required process:
 1. Re-read project/2026-06-01-next-16-upgrade-plan.md and this report before updating the PR.
 2. Get explicit user approval before running pnpm audit because npm audit submits dependency inventory to the configured registry.
-3. Repair or reinstall the missing local Playwright Firefox/WebKit browser binaries; the previous `playwright install firefox webkit` attempt stalled in the downloader after partially downloading Firefox.
+3. Repair or reinstall the missing local Playwright Firefox/WebKit browser binaries; two `playwright install firefox webkit` attempts stalled in the downloader after Firefox reached 100%, including a temp-cache retry at `/private/tmp/klicker-next16-pw-browsers`.
 4. Run:
    - `pnpm audit --audit-level high`
    - `PLAYWRIGHT_BASE_URL=http://127.0.0.1:3001 pnpm --filter @klicker-uzh/playwright test:run`