docs: API-key path marked dead per prior-session evidence

ses_eec320fe4ffehaMAn44U1nTKJU verified both real keys, all documented
auth schemes, and two endpoints -> 401 unconditionally, with historical
proof the same creds worked in 2024-2025 (13.5k bookmarks downloaded).
Goal 2 is now 'plugin rides the webapp cookie path', with the cookie-
rotation cost explicit (2-iii); the earlier DECISION POINT framing
('try a real key') contradicted that record and is removed.

Generated-by: opencode (GLM)

capsite-checklist.md

@@ -33,17 +33,21 @@ it has passed verification itself). Working notes live under each goal;
         - [ ] 1b-ii. Prod mint + handoff: deploy both, mint against
               prod, `wrangler secret put DIIGO_WEB_ID`, dump a page.
 
-  - [ ] **2. madmode collects real bookmarks** (the API-key path)
-        - [ ] 2-i. Real API key: fetch from
-              https://www.diigo.com/settings/api; put in
-              `madmode/.dev.vars` (placeholder now; 401s).
+  - [ ] **2. madmode collects real bookmarks via the webapp cookie path**
+        (API-key path is DEAD — verified in session
+        ses_eec320fe4ffehaMAn44U1nTKJU: both known real keys, all
+        documented schemes (key= param, key+user=, HTTP Basic), both
+        /api/v2/bookmarks and /api/v2/notes → 401 unconditionally, with
+        2024–2025 historical proof the same creds once downloaded 13.5k
+        bookmarks. Diigo deprecated/revoked v2 key auth; the session-
+        cookie /interact_api channel is the one that works.)
+        - [ ] 2-i. Plugin rides the webapp DO: plugin's sync calls
+              diigo-dump's DiigoBridge (or the instance id directly);
+              cookie + host gate stay host-side.
         - [ ] 2-ii. Plugin "Sync now" succeeds: status 200, bookmarks
               stored (admin at /_emdash/admin → Diigo Sync).
-        - [ ] 2-iii. DECISION POINT: if the API-key path stays 401,
-              consider riding the plugin on the webapp cookie path
-              instead (plugin already declares the host gate; the DO
-              would hold the cookie). Prefer the API key if it works —
-              a static key beats a session cookie for cron.
+        - [ ] 2-iii. Cookie-expiry story for cron: rotation is manual
+              (re-mint via /_connect) unless we automate it later.
   - [ ] **3. `/bookmarks` renders real data** after a sync — titles/tags at
         http://localhost:4321/bookmarks.
   - [ ] **4. Cron sync** works locally without errors (`0 */6 * * *` in