Add source-backed Rotten Tomatoes mirror (port 40021) with deterministic verifiers

[jackjin1997]

Add source-backed Rotten Tomatoes mirror as site 22 on port 40021

This branch preserves the original Rotten Tomatoes contribution from #26, integrates it after OSU on current main, and includes the independent PR #87 remediation.

Source and assets

• 270 official movie URLs and cast-and-crew captures, 3,852 credited people, 23 TV records, and 19 feature records.
• Live review audit returned HTTP 200 for all 270 movie URLs and exact current fact matches for all 14 task-critical pages.
• 3,343 local poster, hero, and person images match the catalog SHA-256 values; runtime templates contain no image hotlinks.
• Hugging Face dataset PRs Add NVIDIA mirror site #55 and Add NVIDIA mirror + task verifiers (site by @KaKituken, verifiers by reviewer) #58 are merged. Pinned revision 8f06eba81b2d1cdf62c8c17c9036850d9a6b9c32 contains all 22 site archives.
• Final rotten_tomatoes.tar.gz is media-only and has SHA-256 273a4e674431fbb4cd802d54b5945fb8f3fac225443e0e7b39700dae990b0926.

Remediation

• Removed the committed Flask secret and added explicit request, session-cookie, CSRF, authentication, redirect, query-validation, SQLite foreign-key, and ownership protections.
• Corrected seeded public-review attribution and prevented those records from appearing as Alice's private/deletable reviews.
• Added strict catalog/content validation, populated-seed integrity checks, deterministic credentials/timestamps/index construction, and recoverable migration receipts.
• Rotten Tomatoes now generates a byte-deterministic database during the official Docker build and fails closed when required image/external-cache assets are absent.
• Hardened source-image downloads with origin, content-type, size, decoding, and catalog-hash checks.
• Corrected mobile spacing, Watchlist POST behavior, labels, menu text, current-page semantics, and search result counts.
• Replaced all seven verifiers with database-derived deterministic checks for completed same-origin UI workflows, screenshot sequences, exact filters/searches/click transitions, final-answer binding, unchanged read-only databases, unchanged schema, and bounded state changes.
• Removed the stale overlapping Draft evidence package and replaced it with review-reports/PR-87-FINAL-AUDIT.md.

Validation

• 56 application/source/security/seed/image/migration/environment tests pass with ResourceWarning promoted to errors.
• 10 production-verifier adversarial test methods pass across all seven tasks and controls.
• 7/7 actual Playwright UI task executions and production verifier results pass from fresh databases.
• 56/56 responsive public/private checks at 320, 390, 768, and 1440 px pass with zero broken images, hotlinked images, missing image alt attributes, console errors, page errors, or page-level overflow.
• 4,190/4,190 local routes return HTTP 200.
• A clean official Docker build with OSU and Rotten Tomatoes host seed directories absent passes; final image is sha256:b645d600d40bbccb3007c113f253a028e08423a3703721ca99b3b349a23fd933.
• All 22 sites are alive and return HTTP 200. Dirty restart persistence, /reset/rotten_tomatoes, /reset/osu, and /reset-all pass with exact seed restoration.

The consolidated audit is in review-reports/PR-87-FINAL-AUDIT.md.

[jackjin1997]

Independent first-round blind judgment (frozen execution packet)

• Judge model: Claude Fable 5.1 (claude-fable-5-1, Claude Code session; exact deployment alias not verifiable from inside the session, recorded as reported).
• Versions: review candidate code 201324a59be7803d916a3570dee2f539d406ff98; asset revision 2ec8b226ce8c8cdcdd531812b9738811264eb0ce; Review PR head at freeze 876e26151a799b3f36b95b50ed2a59e3cf87419b; manifest SHA256 b567ee039fab832b2637a79ea58aaafede12fa5f536619263d58296c099a2761 (all 664 enumerated files verified by size and SHA256). Executions retain their own historical code/asset identities as recorded in the packet; execution-side model deployment aliases are recorded as unavailable.
• Coverage: 7 RottenTomatoes tasks (--0, --3, --8, --9, --11, --14, --18), 9 attempts, each judged separately against its own public task/rubric using the frozen trajectories, canonical screenshots, synchronized DOMs and read-only before/after state.
• Result: all 7 designated candidate attempts PASS. Two earlier non-candidate attempts FAIL on their own evidence: task --3 first attempt (observation failure after 2 steps, no answer) and task --8 first attempt (interrupted before password entry/submit, no persisted change). No evidence was stitched across attempts.
• Not performed: no site/network/browser access, reset or re-execution; no review of grading code/results, hidden truth, prior reviews, source fidelity, code quality or verifier implementation; visual baseline, Owner acceptance and the 22-site Dockerfile build were not assessed. This judgment covers only the frozen executions and does not mark the PR Ready.

[Raibows]

Thanks for your contribution! @jackjin1997 @derenlei

[derenlei]

Thanks for your help @jackjin1997 @Raibows to have it merged!