feat(#1668): M6 — expanded axe ruleset (mobile + image-alt + label) (#1700)

# M6 — expanded axe ruleset (#1668)

**Closes #1668.** M1-M5 already merged: M2 palette/contrast, M3
typography, M4 per-route polish, M5 axe gate + 443→0 fixes.

## What this PR adds

### Expanded axe ruleset
- New rules: image-alt, label, aria-required-attr, aria-valid-attr (12
total, verified 0 violations on master after one fix)
- Mobile viewport (375×812) added alongside existing 1200×900 desktop
- TDD: RED commit `d3e4309e` expands the rule/viewport set deliberately
to fail; GREEN commit `5599068f` adds the one needed aria-label fix on
audio-lab BPM + Volume sliders

## What this PR does NOT include

The letsmesh A/B verification artifact (initially scoped for M6) is
split out to a follow-up issue. The capture script needs more work to
reliably navigate post-onboarding state on both sites. Tracked
separately so the gate-expansion work isn't held up by tooling.

## Test plan
- `test-a11y-axe-1668.js` runs new ruleset across both viewports — 0
violations baseline (on master pre-merge AND post-merge)
- `test-a11y-axe-1668-selftest.js` unchanged (allowlist semantics still
apply)
- Anti-tautology: reverting `5599068f` produces 8 net violations on
`#alabBPM`/`#alabVol` × 2 themes × 2 viewports

## Notes
- Allowlist still empty (per M5 policy — issue# + expires_at required)
- M5 token work covered all color-contrast surfaces; M6's image/aria
additions only required one fix (audio-lab sliders)

---------

Co-authored-by: Kpa-clawbot <bot@openclaw.local>

.github/workflows/deploy.yml

@@ -363,9 +363,15 @@ jobs:
       - name: Run Playwright E2E tests (fail-fast)
         run: |
           BASE_URL=http://localhost:13581 node test-e2e-playwright.js 2>&1 | tee e2e-output.txt
-          # M5 of #1668 — axe-core CI gate (color-contrast AA).
-          # Real browser run; fails on any net violation (raw − allowlist).
-          # Allowlist: tests/a11y-allowlist.yaml (0 entries at M5 baseline).
+          # M5+M6 of #1668 — axe-core CI gate.
+          # M5: color-contrast on desktop dark+light.
+          # M6: expanded ruleset (image-alt, label, aria-required-attr,
+          #     aria-valid-attr, aria-valid-attr-value, landmark-one-main,
+          #     region, button-name, link-name, document-title, html-has-lang,
+          #     duplicate-id) AND adds 375x812 mobile viewport (with
+          #     color-contrast on mobile too).
+          # Allowlist: tests/a11y-allowlist.yaml (0 entries — hard pass policy).
+          # Per-viewport summary printed at the end; any net>0 fails the build.
           BASE_URL=http://localhost:13581 AXE_SCREENSHOT_DIR=/tmp/axe-1668 \
             node test-a11y-axe-1668.js 2>&1 | tee -a e2e-output.txt
           BASE_URL=http://localhost:13581 node test-filter-ux-e2e.js 2>&1 | tee -a e2e-output.txt