[WEB-003] Publish a per-PR visual QA catalog

[veryCrunchy]

Goal

Make every visual application change reviewable through deterministic, privacy-safe captures rendered from the real Compose UI without requiring a phone or personal Nextcloud data.

Acceptance criteria

• Capture scenarios use stable identifiers, declared platforms, viewport dimensions, feature area, state, and pull request metadata.
• The manifest proves capture inputs, image hashes, dimensions, and freshness.
• Stale generated images are removed only when owned by the previous manifest.
• Pull requests can publish focused loading, ready, empty, and failure states using synthetic fixtures.
• The website exposes a responsive visual QA catalog with dense filters and direct pull request grouping.
• News and product pages use only intentional showcase captures rather than failure-state audit images.
• Mobile visitors see a real mobile Compose capture and desktop visitors retain an appropriate desktop presentation.
• Validation runs without ADB, a physical Android device, network access, or private account data.

Safety

Capture fixtures must never contain personal account data, credentials, private server URLs, or destructive live-cloud actions.