Merge origin/main into feat/ui-redesign

Backend, scripts, docs and their tests take main's newer code where both
sides changed the same lines (the shared blob cache, GitHubStream and
markdown fixes landed on main after the Go migration branch was cut).
The Dockerfile keeps the Go build from the migration, plus main's
owner-alert-protocol label; .gitignore keeps both sides' entries.

Frontend keeps the redesign and folds in main's features: Stripe billing
in the New anonymization submit bar, GitHub access repair, redaction
syntax help, the preview expand toggle, configurable redaction mask,
folder counts, reviewer-route header rules, link expiry (now in the
viewer's snapshot details) and the explorer error card. main's
narrow-only wrap logic is dropped because the redesign wraps on desktop
and scrolls sideways on phones.

Tests: 1534 passing with SESSION_SECRET set (as in CI). Three main tests
were updated for the agreed viewer design (no site header in the viewer,
no repository-wide file count).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -40,6 +40,7 @@ jobs:
           --health-cmd "redis-cli ping"
           --health-interval 5s --health-timeout 3s --health-retries 10
     env:
+      BILLING_TEST_MONGODB_URI: mongodb://127.0.0.1:27017/billing_test_ci
       TEST_MONGODB_URI: mongodb://127.0.0.1:27017/dependency_test
       PERFORMANCE_MONGO_URI: mongodb://127.0.0.1:27017/perf_test_ci
       PERFORMANCE_REDIS_PORT: 6379
@@ -53,3 +54,48 @@ jobs:
       - run: npm run build
       - run: npm audit --audit-level=low
       - run: npm test
+
+  review-consent:
+    name: Review consent transactions
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+      - run: npm ci
+      - run: npx tsc --noEmit
+      - name: Start disposable MongoDB replica set
+        run: |
+          docker run -d --name review-consent-test --network host --memory=1g --cpus=1 --tmpfs /data/db:rw,noexec,nosuid,size=512m mongo:7.0@sha256:0e145625e78b94224d16222ff2609c4621ff6e2c390300e4e6bf698305596792 mongod --bind_ip 127.0.0.1 --port 28743 --replSet review-consent-test --oplogSize 16
+          for attempt in $(seq 1 40); do
+            if docker exec review-consent-test mongosh --quiet --port 28743 --eval 'db.adminCommand({ping:1})' > /dev/null 2>&1; then break; fi
+            sleep 1
+          done
+          docker exec review-consent-test mongosh --quiet --port 28743 --eval 'rs.initiate({_id:"review-consent-test",members:[{_id:0,host:"127.0.0.1:28743"}]})'
+          for attempt in $(seq 1 40); do
+            if docker exec review-consent-test mongosh --quiet --port 28743 --eval 'if (!db.hello().isWritablePrimary) quit(1)' > /dev/null 2>&1; then exit 0; fi
+            sleep 1
+          done
+          exit 1
+      - name: Verify consent authority, concurrency and replay cost
+        env:
+          TEST_REVIEW_CONSENT_MONGO: mongodb://127.0.0.1:28743/?replicaSet=review-consent-test
+          TEST_REVIEW_CONSENT_PERF_REPORT: review-consent-perf.json
+          TEST_REVIEW_COMPLETION_HTTP_PERF: review-completion-http-perf.json
+          TEST_REVIEW_COMPLETION_PERF_REPORT: review-completion-perf.json
+          TEST_REVIEW_CONSENT_HTTP_PERF: review-consent-http-perf.json
+        run: npx mocha test/review-owner-consent.test.js test/review-consent-http.test.js test/review-completion-http.test.js
+      - uses: actions/upload-artifact@v4
+        with:
+          name: review-consent-performance
+          path: |
+            review-consent-perf.json
+            review-consent-http-perf.json
+            review-completion-perf.json
+            review-completion-http-perf.json
+      - name: Remove disposable database
+        if: always()
+        run: docker rm -f review-consent-test || true