Add authorized Storm Card inspection

Connect the six numeric reference faces, the existing private Fremen forecast and actual public reveals to a shared enlarged inspector. Create the structured public chronicle component only where beginStormTurn reveals the card. Weather Control and Ecological Testing Station may change effective movement but never rewrite the original receipt. No draw, movement, AI strategy or mode gate changes.

The face reader accepts only exact stormCard metadata with an integer value1 through6. Legacy text-only history still renders normally. Existing JSON saves preserve valid receipts within the normal250-entry chronicle; no card is inferred from a private forecast, current pending distance or old log text. Five new tests use genuine Advanced fixtures to verify forecast allowance/cancellation and privacy, public reveal, JSON/legacy continuation and original-versus-modified distances. The related reference suite also passes (17 focused cases total).

Independent privacy/provenance/UI review found no material findings. The initial check stopped at an accessibility lint rule; replacing the numeric group with a semantic figure resolved it, followed by a fresh final run and mobile recheck. Required types, lint, 4946 offline tests, production build and 46 HTTP tests pass on stable final source. Browser QA opens all six reference faces, uses keyboard Enter/Escape and checks settled modal focus/return. At390px the modal is359px wide and fits the viewport; Close is44px high. The viewport was reset. Screenshot capture remains unavailable, so full visual acceptance is not claimed. Live Advanced browser play and final manufactured-face/artwork verification remain open; fixture privacy checks and gallery controls are narrower evidence.

The existing server remained running. All 1337 original rooms, 2805 seats and existing recovery/entry/handover/delegation/migration rows remain unchanged; SQLite integrity and foreign keys pass. HTTP tests created only their own additional QA records. No database migration/reset, hourly automation, account-usage check or AI calibration. Standing automatic push authorization retained.

Private evidence: 20260921-storm-card-inspection.
Verified source tree: 3856e73f3cc3bb50003b6afda6ab4d08a513191c4e300e7742c2b5179a05cff1

docs/CURRENT_STATUS.md

@@ -6,22 +6,23 @@ gated.** Prototypes do not open completion or publication gates.
 
 ## Current checkpoint and work
 
-Latest delivered checkpoint: `c4ff75a`, [interactive alliance practice](INTERACTIVE_INTRODUCTION.md).
-Types, lint, **4,934 offline tests** and production build passed. All 1,337 rooms,
+Latest delivered checkpoint: `67e429e`, [Charity and Revival practice](INTERACTIVE_INTRODUCTION.md).
+Types, lint, **4,941 offline tests** and production build passed. All 1,337 rooms,
 2,805 seats and existing recovery/entry/handover/delegation rows stayed unchanged.
-The stopped server was started against existing state; an existing QA seat restored.
-The preceding `b7ec940` connects bidding practice, `b9718ac` connects
+The running server was reused; prior lesson results and paid returns restore.
+The preceding `c4ff75a` connects alliance practice, `b7ec940` connects bidding,
+and `b9718ac` connects
 [lobby AI configuration](LOBBY_AI_CONFIGURATION.md), and `b21b2bc` connects
 [one-use AI permission](SEAT_AI_PERMISSION.md). The `8f7a62c` policy checkpoint
 removed the usage cutoff and deferred AI refinement until feature completion,
 with three adjacent 75% targets. Earlier evidence remains in the
 [implementation history](IMPLEMENTATION_STATUS.md).
 
-Current work: [Charity and Revival practice](INTERACTIVE_INTRODUCTION.md) adds two
-Basic phase lessons, cumulative free/paid returns, leader eligibility and shared
-spending through existing production calculations. Saved choices migrate every
-earlier lesson and commitment. No AI strategy changes. Final independent review,
-browser/check/build/preservation and Git evidence belong to its private report.
+Current work: [Storm Card inspection](STORM_CARD_INSPECTION.md) connects six
+reference faces, the permitted Fremen forecast and public chronicle receipts to
+enlarged inspection. Original card values stay separate from modified movement;
+legacy text logs remain valid. No rules or AI strategy changes. Independent review,
+browser/check/build/HTTP/preservation and Git evidence belong to its private report.
 A bounded current-state Duke review confirmed revival/loan paths still cross
 recorded custody, return and cycle questions; existing identity/price helpers and
 non-Ecaz guards are already present. No duplicate ruling or invented outcome.