fixup! feat(diigo-dump): session-cookie dump worker, manual test passing

fixup: scrub failed API-key ping from checklist

diigo-ping never authenticated (Diigo 401); the working path is the
session-cookie dump worker. Renumber steps, note the scrub with the
reason, and drop the ping how-to.

Generated-by: opencode (GLM)

capsite-checklist.md

@@ -1,24 +1,19 @@
 # capsite checklist
 
-Goal ladder toward "EmDash site collecting diigo.com bookmarks with the API key
+Goal ladder toward "an EmDash site collecting diigo.com bookmarks, credentials
 held by the host, never inside the plugin" (see capsite-notes.md).
 Start small; each step must pass before moving down.
 
-- [x] **1. Plain worker ping** (`diigo-ping/`): a Cloudflare Worker with one
+- [x] **1. Cookie-path dump worker** (`diigo-dump/`): port of
-      ping button that calls `https://www.diigo.com/api/v2/bookmarks` with HTTP
-      Basic auth (`username:apiKey`) and shows the raw result in a `<pre>`.
-      Secrets from `.dev.vars` locally / `wrangler secret put` deployed.
-      **Win:** page shows `status: 200 ok` and real bookmark JSON.
-      **Result (2026-10-06):** worker runs; Diigo returns 401 with the current
-      key/username pair — API-key path not yet authenticated.
-- [x] **1b. Cookie-path dump worker** (`diigo-dump/`): port of
       `mm-diigo/projects/diigo-bak/diigo-dump.mjs` — one page-number field +
       button, GET `interact_api/load_user_items?sort=updated&count=24&page_num=N`
       with the browser session cookie (`DIIGO_COOKIE` secret).
       **Result (2026-10-06):** manual integration test PASSES —
       status 200, `total: 1674`, page-1 items returned. GET / is inert; dump
-      only on POST submit. The session-cookie / interact_api path works while
+      only on POST submit.
-      the API-key path is rejected.
+      (2026-10-06, scrubbed: a static API-key ping worker, `diigo-ping/`,
+      was tried first and failed — Diigo rejected the key pair with 401.
+      The session-cookie / interact_api path is the one that works.)
 - [ ] **2. Real credentials in madmode/.dev.vars**: replace the placeholder
       `DIIGO_API_KEY="dckc-madmode"` with a key from
       https://www.diigo.com/settings/api; confirm the EmDash plugin's
@@ -28,26 +23,10 @@ Start small; each step must pass before moving down.
 - [ ] **4. Cron sync works** locally without errors (`0 */6 * * *` task in
       `_emdash_cron_tasks`).
 - [ ] **5. Deploy**: madmode to Workers `pnpm wrangler deploy`, secrets via
-      `wrangler secret put`; ping page then plugin "Sync now" against prod.
+      `wrangler secret put`; plugin "Sync now" against prod.
 - [ ] **6. bib sync #195**: repeat the pattern for the next read-access need.
 
-## Step 1 how-to: diigo-ping
+## Step 1 how-to: diigo-dump (session-cookie path)
-
-```bash
-cd diigo-ping
-printf 'DIIGO_API_KEY="dckc-madmode"\nDIIGO_USERNAME="6edadc55c0329434"\n' > .dev.vars
-npx wrangler dev            # → http://localhost:8787
-```
-
-Click the button; expected right now (same credentials as the plugin):
-Diigo `401 ... "HTTP Basic: Access denied"`. If even the standalone worker
-can't authenticate, the credentials are wrong, not the plugin wiring.
-
-Note: Diigo 301s `secure.diigo.com` → `www.diigo.com`; fetch follows the
-redirect, and the Authorization header survives host-to-host here — if Diigo
-ever strips it, switch the URL to `www.diigo.com` explicitly.
-
-## Step 1b how-to: diigo-dump (session-cookie path)
 
 ```bash
 cd diigo-dump