Add Playwright tests for live site authentication and race page loading

- Introduced `auth.setup.js` to handle authentication against the live site and store the session state.
- Created `live-race.spec.js` to test loading a live race page with an authenticated session, including cookie validation.
- Added utility functions in `live-site-test-utils.js` for managing authentication, dismissing cookie banners, and checking UI states.
- Included a temporary JSON file for live state inspection.
- Updated deployment manifest to reflect new and modified files.
- Implemented `_inc_faceai_identity.jsp` for managing FaceAI identity cookies and included it in relevant JSP files.
- Added language management JavaScript in `lang.js`.
- Adjusted `fotoCR-en.jsp` and `fotoCR.jsp` to include the FaceAI identity logic.
- Created a tarball for staging deployment.

.github/instructions/instructions.instructions.md

@@ -102,6 +102,7 @@ code example here
 - **Include Examples**: Real code snippets are more effective than descriptions
 - **Stay Current**: Reference current versions and best practices
 - **Link Resources**: Include official documentation and authoritative sources
+- **Capture validated shell quirks**: For environment-specific instruction files, record proven terminal behaviors, quoting pitfalls, failing command patterns, and the known-good command form that replaced them
 
 ### Instruction Altitude (Goldilocks Zone)
 

.github/instructions/regalamiunsorriso-83-149-164-4.instructions.md

@@ -35,6 +35,12 @@ If you need a single elevated command:
 ssh -tt -i C:\Users\Maddo\.ssh\id_rsa -p 410 marco@83.149.164.4 "sudo tcsh -c 'command here'"
 ```
 
+From PowerShell on Windows, prefer invoking the SSH binary directly instead of wrapping it in `cmd /c`:
+
+```powershell
+& 'C:\Windows\System32\OpenSSH\ssh.exe' -tt -i 'C:\Users\Maddo\.ssh\id_rsa' -p 410 'marco@83.149.164.4'
+```
+
 ## Shell Behavior On This Host
 
 - The remote login shell behaves as `tcsh`.
@@ -42,11 +48,15 @@ ssh -tt -i C:\Users\Maddo\.ssh\id_rsa -p 410 marco@83.149.164.4 "sudo tcsh -c 'c
 - The server `sh` does not support `-l`, so use `sh -c`, not `sh -lc`.
 - `tcsh` treats redirection and pipelines differently from POSIX shells; commands like `find ... 2>/dev/null | head` can fail with `Ambiguous output redirect` unless the whole payload runs under `sh -c`.
 - Prefer one remote command per SSH invocation when doing reconnaissance. Complex commands with pipes, grouped expressions, or escaped parentheses are much more likely to break under PowerShell-to-SSH-to-`tcsh` quoting.
+- On Windows PowerShell, avoid `cmd /c "ssh ..."` and `cmd /c "scp ..."` wrappers for anything nontrivial. Nested quoting can collapse before SSH runs and spill later tokens into the local PowerShell session, which leads to misleading local errors such as `sudo: The term 'sudo' is not recognized` or local attempts to run `cksum`.
+- Prefer the PowerShell call operator form `& 'C:\Windows\System32\OpenSSH\ssh.exe' ...` and pass the remote command as a single argument when you must stay non-interactive.
 - If PowerShell shows the continuation prompt `? >`, the command was malformed locally before SSH executed it. Cancel it and rerun a simpler command instead of trying to answer the prompt.
 - If `sudo` reports that a terminal is required, reconnect with `-tt`.
 - When running remote commands from PowerShell, quoting can break if the command contains both nested quotes and file paths with spaces.
 - For read-only verification commands from PowerShell, prefer `ssh ... --% <remote command>` so the remote command is passed verbatim.
 - For `promote-file.sh` calls that target paths with spaces, prefer a local PowerShell loop that passes the full remote command as a single SSH argument instead of building one long nested quoted command.
+- For multi-step privileged work, prefer opening one interactive SSH session, then running `sudo tcsh`, then issuing commands sequentially inside that shell. This is more reliable than trying to encode several `sudo tcsh -c 'a ; b ; c'` operations through PowerShell quoting.
+- In an interactive `tcsh` root shell, do not re-send a password or any other text starting with `!` after the password prompt has already succeeded. `tcsh` interprets `!` as history expansion and will emit `Event not found`.
 - If repeated SSH commands start cancelling or interleaving poorly in the same terminal, rerun them sequentially instead of in parallel.
 
 ## Mail Template Runtime Notes
@@ -88,6 +98,14 @@ ssh -tt -i C:\Users\Maddo\.ssh\id_rsa -p 410 marco@83.149.164.4 "sudo tcsh -c 'c
 - Incoming staging root: `/home/marco/regalamiunsorriso/incoming/www`
 - Live site root: `/home/sites/regalamiunsorriso/www`
 
+## Tomcat Logs And Runtime Clues
+
+- The active Tomcat installation on this host is under `/usr/local/apache-tomcat-9.0`.
+- The most useful live runtime log is `/usr/local/apache-tomcat-9.0/logs/catalina.out`.
+- Rotated Tomcat logs are under `/usr/local/apache-tomcat-9.0/logs/`, including files such as `catalina.YYYY-MM-DD.log` and `localhost.YYYY-MM-DD.log`.
+- Access to generated JSP work files under `/usr/local/apache-tomcat-9.0/work` may require root.
+- A broken JSP on this host can still return `HTTP 200` with a visibly truncated HTML body instead of a clean 500 response; when that happens, fetch part of the page body with `curl -L <url> | head -n ...` and compare the cutoff point with recent `catalina.out` output.
+
 ## Staging Workflow
 
 When `www/**` files need deployment:
@@ -103,6 +121,9 @@ Example staging command pattern:
 tar -cf - -C K:\various\regalamiunsorriso <file-list-under-www> | ssh -i C:\Users\Maddo\.ssh\id_rsa -p 410 marco@83.149.164.4 "tar -xf - -C /home/marco/regalamiunsorriso/incoming"
 ```
 
+- The streamed tar extraction into `/home/marco/regalamiunsorriso/incoming` works as the unprivileged `marco` user and avoids the permission problems seen when uploading an archive and trying to unpack it with `sudo tar`.
+- Do not rely on `sudo tar` for staging on this host. `marco` is not permitted to run that extraction as root.
+
 ## Promotion Rules
 
 - Promotion to the live site must happen through `sudo tcsh`.
@@ -136,6 +157,13 @@ $remote = "sudo tcsh -c \"/home/marco/promote-file.sh '<staged-path>' '<live-pat
 & ssh -tt -i 'C:\Users\Maddo\.ssh\id_rsa' -p 410 'marco@83.149.164.4' $remote
 ```
 
+If the deployment needs more than one privileged action or may prompt for a password, prefer this sequence instead of packing everything into one quoted SSH command:
+
+1. Open an interactive SSH session with `-tt`.
+2. Run `sudo tcsh`.
+3. Run `/home/marco/promote-file.sh ...` commands one at a time.
+4. Run `ls -l`, `stat -f`, and `cksum` in that same root shell.
+
 Behavior of `promote-file.sh`:
 
 - If the destination already exists, it copies the file and restores that destination file's original owner, group, and mode.