browserrot(gitea): M-B4 LIVE-REAL — first real site-side password rotation

Rotated the self-owned Gitea login password end-to-end via the new
lab/rung4-gitea-browser harness: backup-gated (Hard Rule 1) -> pre-change
login(OLD) -> change-form submit -> new stored to gopass -> verified by
browser re-login AND independent API re-auth. GiteaSite promoted to
ProofLiveReal (proof-as-data).

Three real-site fixes surfaced by the live-fire:
- sites.go: Gitea login + "Update Password" buttons carry no type=submit
  ATTRIBUTE (only the default DOM property), so CSS [type=submit] misses;
  select by class / the account form's sole button instead.
- rod.go: Click now waits for the post-submit navigation to settle before
  the success text is read (a remote round-trip, unlike the instant
  in-process test) — else Text() resolves against the pre-submit page.
- rod.go: new RodDriver.Insecure (--ignore-certificate-errors) for the
  self-signed / Tailscale-fronted host (browser analog of curl -k).

Suite green + -race clean; docs (BROWSER-ROTATION.md §9, BROWSERROT-PLAN.md)
and OVERSEER-STATUS updated.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/browserrot/browserrot_test.go

@@ -352,9 +352,10 @@ func TestGiteaSite_recipeShape(t *testing.T) {
 	if s.Login.URL == "" || s.Form.CurrentSel == "" || s.Form.NewSel == "" || s.Form.SubmitSel == "" {
 		t.Fatalf("recipe has empty required selectors: %+v", s)
 	}
-	// A seed recipe is UNPROVEN until actually run against the real instance (proof-as-data).
-	if s.Proof != rotate.ProofUnproven {
-		t.Fatalf("a fresh curated recipe must be ProofUnproven, got %v", s.Proof)
+	// Promoted to LIVE-REAL: the recipe drove a real self-owned Gitea password
+	// rotation on 2026-07-21 (lab/rung4-gitea-browser, M-B4). Proof-as-data.
+	if s.Proof != rotate.ProofLiveReal {
+		t.Fatalf("GiteaSite recipe should be ProofLiveReal after the M-B4 live-fire, got %v", s.Proof)
 	}
 }