docs(template): record the 2026-07-13 audit-fix sync in provenance

Note that the branch is now maintained (grown beyond the snapshot) and
enumerate the six ported clusters, including the auth-only reductions of
core-cms and web-next.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016j8z4VHjedXDTjEDNg7qHK

TEMPLATE.md

@@ -67,6 +67,44 @@ release-please config as the template default (hybrid per-feature versioning
 is a documented alternative — see ADR-021, `docs/guides/releasing.md`, and
 the pre-retrofit config in the source repo's git history).
 
+## Audit-fix sync — 2026-07-13
+
+This branch is now a maintained template branch (it has grown beyond the
+original 2-commit snapshot). On 2026-07-13 the applicable subset of the
+upstream template audit-fix effort was ported here, adapted to the
+clean-slate auth-only shape. Six coherent commits landed on top of the
+snapshot:
+
+- **chore(tooling)** — root playwright config in `test:visual`, pruned dead
+  `VERCEL_ENV` from `turbo.json`, single Chromium install in CI, a dedicated
+  `vitest.scripts.config.mjs` + `pnpm test:scripts` runner for `scripts/`
+  (node:test → vitest), repo-wide `*.tsbuildinfo` gitignore + untrack, and
+  every `@trpc/*` range aligned on `^11.18.0`.
+- **fix(compliance)** — DSR caller-scoping + audit-trail exports, consent
+  allow-list/merge/superjson, core-audit keyed 128-bit pseudonyms +
+  audit-logs collection + GDPR erasure hook, core-shared retention-purge
+  (task + tombstone + boot registration) and the `require-authenticated`
+  tRPC helper. **core-cms was reduced to the auth-only collection set**
+  (users + audit-logs; the users+workspaces shape from the product fork does
+  not apply — there is no workspaces feature here).
+- **fix(auth)** — server-side jti session-revocation denylist,
+  constant-time signature compare, server-derived `clientIp` (dropped from
+  the public sign-in schema), crypto-path tests, and the users DSR pii map.
+- **refactor(core-trpc)** — removed the illegal `core-trpc → core-api`
+  edge; the context + providers are now `AnyTRPCRouter`-generic.
+- **feat(web-next)** — per-request `createWebNextTrpcContext` (server user
+  resolution + live consent/dsr bindings), compliance bindings in
+  `bind-production`, and manifest-seeded `InMemoryRateLimit` on the
+  production path. **Reduced to the auth-only shell** — no workspaces
+  binder, no product discovery/runner provisioning.
+- **test(coverage)** — cover-the-diff repairs for the ported auth router +
+  core-dsr export, plus mirrored coverage-diff excludes.
+
+The four upstream demo-feature fixes (blog/media/marketing-pages/navigation)
+were skipped — those features do not exist on this branch. No product code
+or naming was introduced; the sole intentional occurrence of the source
+product's name remains this provenance note.
+
 ## How to start a project from this branch
 
 ```bash