test(12.1): add rendered-flow integration tests and security gate evidence

- Add CloudFolderRenderedFlow.test.js: 7 tests mounting real CloudFolderView
  with real StorageBrowser/BreadcrumbBar (only API and router stubbed)
  — mixed root render, opaque-ref folder navigation, breadcrumb lineage,
    warning freshness cached rows, fresh freshness, XSS text escaping
- Update 12.1-VALIDATION.md with Task 3 security gate results:
  bandit 0 HIGH, npm audit 0 critical, no Phase-12.1 gitleaks findings,
  595 backend / 376 frontend tests pass, build clean

.planning/phases/12.1-fix-nextcloud-root-listing-and-sync-visibility/12.1-VALIDATION.md

@@ -1,6 +1,6 @@
 # Phase 12.1: Fix Nextcloud Root Listing and Sync Visibility — Validation Matrix
 
-**Status:** Plan 04 Task 2 complete. Fixture owner-confirmed; exact-acceptance test enabled.
+**Status:** Plan 04 Task 3 complete. All regression, security, and rendered-flow gates pass.
 **Updated:** 2026-06-22
 
 ---
@@ -142,3 +142,25 @@ exact kind equality against the confirmed fixture.
 - Marker excluded from default runs via `pytest.ini`
 - Three live tests: adapter metadata, sanitized root diagnostic, connection-ID end-to-end
 - Task 2 (exact-name acceptance) deferred to checkpoint — fixture not yet created
+
+### Plan 04 Task 2 — Fixture Reconciliation
+
+- Owner confirmed corrected names for 3 previously unmatched items (2026-06-22)
+- `backend/tests/fixtures/cloud/nextcloud_expected_root.json` created with `owner_confirmed: true`
+- `test_nextcloud_expected_root_manifest` enabled with exact set and kind equality (T-12.1-19)
+- Unexpected provider names remain withheld (T-12.1-20)
+
+### Plan 04 Task 3 — Full Regression, Security, and Rendered-Flow Gates
+
+| Gate | Command | Result |
+|------|---------|--------|
+| Bandit HIGH findings | `bandit -r backend/ -q` | 0 HIGH (10 LOW, pre-existing) |
+| npm audit high/critical | `npm audit --audit-level=high` | 0 vulnerabilities |
+| Git tracked .env files | `git ls-files '.env' '.env.*'` | None (only .env.example) |
+| Secret scan new findings | `gitleaks detect --redact` | 3 findings, all pre-existing in old commits (May 2026), none from Phase 12.1 |
+| Docker Compose config | `docker compose config --quiet` | Clean |
+| Focused cloud tests | `pytest test_cloud_*.py test_webdav_backend.py` | 236 pass |
+| Full backend suite | `pytest -v` | 595 pass, 1 pre-existing failure (test_extract_docx, unrelated) |
+| Full frontend suite | `npm test` | 376 pass (7 new from CloudFolderRenderedFlow.test.js) |
+| Frontend build | `npm run build` | Clean |
+| Rendered flow test | `npm test -- --run CloudFolderRenderedFlow.test.js` | 7 pass |