feat: Article Dossier page + metabox dossier link + board deeplinks (v0.19.2)

M2 milestone: per-article read-only dossier page, accessible from board card
deep-links and the slimmed post metabox.

## New admin page
- class-dossier-page.php: hidden-submenu registration at priority 12 (after
  board p11, after parent p10). Secured by manage_options + nonce. Static
  url_for_post() provides canonical deep-link.
- class-dossier-data-assembler.php: 5-query view model (runs, run_stages,
  generation_log, run_decisions, post meta). No N+1. Legacy graceful state:
  posts with no run record return has_run=false.
- class-dossier-gen-log-query.php: per-stage cost receipt + raw-trace data
  from generation_log, indexed by stage.

## Templates
- dossier-page.php: two-column layout (stage sections + sidebar with cost
  receipt). Verdict pills. Editorial decisions section.
- dossier-stage-section.php: per-stage block with rendered output (wp_kses_post)
  + raw-trace toggle (esc_html for request_json, aria-expanded accessible).
- metabox-dossier-link.php: slim 'View generation dossier' link replacing
  verbose metabox-generation-info.php.

## Assets
- dossier.css: warm editorial palette, verdict pills, cost receipt, toggle.
- dossier.js: vanilla JS raw-trace toggle (DOMContentLoaded, aria-expanded).
- board.js: dossier click_action handler before review handler.

## Tests
- DossierMenuRegistrationTest.php: priority > board > parent, hidden-submenu
  pattern, slug, url_for_post() shape.
- DossierDataAssemblerTest.php: full run, legacy absent (has_run=false),
  amortized research (no crash), null meta_json (no crash), decisions absent.

## Bindings satisfied
1. split-class-prautoblogger: DONE (prior commit)
2. Menu ordering: dossier p12 > board p11 > parent p10
3. peptide-e2e smoke: PR 2 (separate repo, this milestone)
4. Raw-trace redaction: request_json via esc_html(), output via wp_kses_post()
5. Legacy graceful: has_run=false path, no notices/fatals
6. v0.19.2 + CHANGELOG + ARCHITECTURE.md in this commit; phpcbf run clean

Agent-Session: claude-sonnet-4-6

CHANGELOG.md

@@ -5,6 +5,42 @@ All notable changes to PRAutoBlogger will be documented in this file.
 Format follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project uses [Semantic Versioning](https://semver.org/).
 
+## [0.19.2] - 2026-06-12
+
+### Added
+- **Article Dossier page (M2).** Per-article read-only inspection page at
+  `admin.php?page=prautoblogger-dossier&post_id=<id>`. Accessible via board card
+  deep-links and the slim post metabox link. Shows: header (title, verdict pill, tier,
+  status), sidebar (run metadata, per-stage cost receipt with model + prompt-version),
+  vertical stage sections (rendered output default, per-stage raw-trace toggle exposing
+  `generation_log` request JSON + tokens + cost + role), editorial decisions rationale,
+  image A/B pair sections.
+- **Board card deep-links.** All Kanban cards now deep-link directly to the article
+  dossier page (`dossier_url` on card data; `click_action = dossier` in board JS).
+- **Slim post metabox.** `PRAutoBlogger_Post_Metabox` now renders a single "View
+  generation dossier →" link (was a verbose generation-metadata dump).
+- **Dossier CSS/JS.** `assets/css/dossier.css` (warm editorial palette, verdict pills,
+  cost receipt, raw-trace toggle) + `assets/js/dossier.js` (vanilla JS toggle,
+  `aria-expanded` / `aria-controls` accessible).
+- **Menu registration test coverage.** `DossierMenuRegistrationTest.php` — asserts
+  dossier hook fires at priority > board (> parent), uses hidden-submenu pattern,
+  correct slug, and `url_for_post()` URL shape. Mirrors `BoardMenuRegistrationTest`.
+- **Raw-trace credential check (binding 4).** `request_json` column contains only
+  OpenRouter request bodies (model, messages, temperature — no Authorization headers
+  per architecture). All model output escaped via `esc_html()` / `wp_kses_post()`;
+  treated as untrusted HTML throughout the render path.
+- **Legacy graceful state (binding 5).** Posts with no run record (pre-v0.18.0) render
+  a clean "No generation record" notice — no notices, no fatals. Amortized research
+  rows (pv=null, role='') render model as "—" with no raw-trace toggle.
+
+### Changed
+- **`class-prautoblogger.php` → `class-db-migrations.php` split (binding 1).**
+  All DB-migration methods extracted byte-identically into new static class
+  `PRAutoBlogger_DB_Migrations` (`includes/class-db-migrations.php`, 129 lines).
+  `class-prautoblogger.php` shrinks from 407 → 258 lines; delegates via thin proxy.
+  Loaded via explicit `require_once` in `prautoblogger.php` (autoloader filename
+  collision avoidance — see ARCHITECTURE.md §File Naming Notes).
+
 ## [0.19.1] - 2026-06-12
 
 ### Fixed