Abrams Report

- .gitignore now excludes *.bak, *.bak.*, *.pre-*, *.orig, *.rej, *~, .next/
  so accidental snapshot files never enter the tree.
- New Express middleware (before express.static) returns 404 for any path
  matching .bak / .pre- / .orig / .rej / trailing-tilde patterns, so even if
  a snapshot file slips into public/ it can't serve.

No behavior change for normal traffic.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

CloudFront 403s data-center IPs (Kamatera prod) but allows residential
(Mac2). Force Browserbase so the scheduled scrape works on Kamatera.

abrams-report's own .env (written by secrets-manager) is the canonical
location on both Mac2 and Kamatera. Move it to the front of the
candidate list so a per-project key rotation propagates immediately
instead of being shadowed by an older skill .env on Mac2 or /root/.env
on Kamatera.

Wallquest is behind Cloudflare bot protection; only path to scrape its
sitemap is via Browserbase's residential-IP Chromium cluster. Adding
the SDK + playwright-core as direct deps so 'npm install --omit=dev'
on Kamatera pulls them in. fetch-browserbase.js falls back to loading
from ~/.claude/skills/browserbase/node_modules on Mac2 when these are
absent, so this dep addition is additive, not a hard requirement on
the dev box.

Each source now yields 3-6 real headlines per run. Changes:

- Schumacher: switched fschumacher.com/search to schumacher.com/blog
  (parent brand publishes a real editorial blog; selector 'h3 a').
- Thibaut: news/blog paths all 404, switched to /sitemaps/collections.xml
  with sitemap parser (lastmod = newest collection drop).
- Phillip Jeffries: /news redirects to /shop; switched to blog subdomain
  blog.phillipjeffries.com with 'h2 a' selector.
- Scalamandre: /news page literally says 'No news!'; switched to flat
  sitemap.xml filtered to /brands/.+/.+\.html collection pages, sorted
  by lastmod (newest collection updates).
- Maya Romanoff: kept /news/ URL but tightened selector to 'h2 a' and
  link filter to /news/<slug>/ (was matching every nav link).
- Arte International: switched from /en/collections to /en/stories with
  selector a[href*=/stories/] and slug filter (rejects ?category= nav).
- Brewster: /new-arrivals 404s; switched to /blog with 'h3 a' selector
  and a host-anchored slug filter.
- York: tightened to a[href*=/blog/] + excludeFilter for tag/month/rss
  (was matching navigation tag clouds).
- Wallquest: blocked by Cloudflare bot challenge AND publishes nothing
  to /news or /blog. Routed through Browserbase, fetching sitemap.xml
  via the same-origin fetch (page.evaluate) to bypass Chrome's XML
  pretty-print wrapper; filtered slugs to human-readable collection
  names (≥1 dash, no SKU codes).
- Cole & Son: /en/news redirects to homepage; switched to
  sitemap_blogs_1.xml, parse <image:title> as headline.

Infrastructure:
- New scrapers/fetch-browserbase.js for cloud-Chromium fetches; loads
  creds from ~/.claude/skills/browserbase/.env, /root/.env, or process.
  When URL contains 'sitemap' or '.xml', uses page.evaluate(fetch) to
  return raw XML (not Chrome's wrapper HTML).
- scrape-html.js: real Chrome UA (was scraper bot UA — many sites
  403/404 a bot), redirect: 'follow', new parsers for 'sitemap' and
  'sitemap-index', new 'excludeFilter' for rejecting category/tag/etc,
  cap of 6 headlines per source (per copyright-safety brief).