v4.7.0 — match with strings, not regexp

Mirrors baseline v4.7.0, import a package for what it does, pinning baseline commit d12a127.

Two test helpers dropped regexp. The "Show older" cursor and the machine-token secret are now found with strings.Cut and strings.IndexFunc. For every page the app renders they match exactly what the regexps matched: the cursor is digits only, and the secret is gochat_ plus RawURL base64. Production code imports neither regexp nor reflect.

./verify.sh exits 0 over 79 gates, and make ci is green on this commit. Nothing needed a waiver.