New Items Dashboard

7 assertions covering unauth-401 on /, /api/new-wines, /api/new-handbags,
/api/stats, WWW-Authenticate present, valid-creds non-401, wrong-creds 401.
Standalone (no framework dep); wired to npm test.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Mounts an Express middleware before any route declaration so /api/new-wines,
/api/new-handbags, /api/stats and the HTML dashboard all require credentials.
Credentials come from env BASIC_AUTH (user:pass form); placeholder is left in
code with a SECURITY: rotate-before-deploy comment. In dev (NODE_ENV !=
production) with no BASIC_AUTH set, the gate fails open for local convenience.
Uses crypto.timingSafeEqual to dodge length-leak side channels.

.env.example documents BASIC_AUTH + NODE_ENV. .gitignore exempts .env.example
so the template can be tracked.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Per Steve's standing rule, every product/item grid must have a working
sort <select> + density slider, both persisted to localStorage and
hydrated BEFORE the first fetch.

Frontend (public/index.html):
- New .grid-controls toolbar above each tab grid with sort select
  (Newest / Vendor / Series / SKU / Title) + density range input
  (180-480px card-min via CSS var --card-min).
- hydrateControls() reads localStorage and sets control values BEFORE
  loadWines/loadHandbags fire, so the first paint already reflects the
  saved user choice instead of flashing default→saved.
- Change handlers persist to namespaced keys (newItemsDash.<tab>.<ctl>)
  then either re-fetch (sort) or just re-apply CSS var (density).
- Grids now render into dedicated <div id=wines-grid> / handbags-grid
  containers so re-renders don't blow away the toolbars.
- applyDensity re-runs after every grid re-render to survive the
  innerHTML wipe.

Server (server.js):
- New applySort(items, sort, type) helper. Honors ?sort=newest|vendor|
  series|sku|title on both /api/new-wines and /api/new-handbags.
- 'vendor' falls back to brand / source when an item lacks vendor;
  'series' falls back to vintage / model. Keeps shape consistent
  across the two heterogeneous data sources.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

- .gitignore now covers *.bak.*, *.pre-*, *.orig, *.rej, *.swp, *~
  (was only *.bak). Prevents editor scratch + Claude pre-edit snapshots
  from sneaking into the repo.
- New Express middleware before express.static returns 404 for any
  request to a snapshot/editor-scratch path so even if one accidentally
  lands under public/ it never serves to a browser.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>