fix(§22.4a): scope RFCView entry-detail fetch to its collection (v0.52.1)

The §9 deployed-environment E2E harness (0.52.0), run against a PPE host
with per-collection-isolated content, surfaced a latent multi-collection
bug: RFCView computed the collection id from the route but called
getRFC(pid, slug) without it, so a named-collection entry was always
fetched via the project default-collection route — which 404s for an entry
that exists only in a named collection ("Error: Not found"; metadata panel
absent). Local/Tier-1 stacks masked it (same slug also reachable via the
default collection). Thread cid through all three getRFC call sites; re-run
the load effect on collection change.

Harness/test-infra (not in the deployed artifact):
- e2e: pre-record cookie consent via addInitScript (lib/fixtures.js) so the
  bottom-fixed consent banner can't intercept catalog row-select clicks on
  the slower deployed edge.
- testing/seed-ppe.sh: fail loudly on any non-2xx Gitea response (a
  swallowed 403 org-repo create had reached the deploy as a 502).
- testing/ppe-deploy-and-test.sh: seed via the Keychain admin token
  (write:organization needed to create the PPE repos); store the E2E secret
  newline-free; read EXPECT_VERSION from VERSION.

Patch bump 0.52.0 → 0.52.1; CHANGELOG updated.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

e2e/lib/fixtures.js

@@ -0,0 +1,40 @@
+// Shared Playwright fixtures for the deployed-environment harness.
+//
+// Pre-record a cookie-consent choice via addInitScript so the §14.5
+// cookie-consent banner NEVER renders. The banner is fixed to the bottom
+// of the viewport and intercepts pointer events over the catalog footer
+// (the row-select checkboxes SLICE-5 clicks). The previous approach —
+// dismiss it after navigation (lib/ui.js dismissCookies) — raced the
+// banner's render on the slower deployed edge (PPE): dismissCookies ran
+// before the banner mounted, found nothing to remove, and the banner then
+// appeared and swallowed the row clicks. Recording consent at
+// document-start (before the app's scripts read `hasChosen()`) means the
+// banner's `open` state initialises false and it never mounts — no race.
+//
+// Storage shape mirrors lib/consent.js (LS_KEY 'rfc-app.cookie-consent.v1';
+// a non-null recorded_at == "the user has chosen"). Environment-agnostic:
+// the init script runs on whatever origin the test navigates to (PPE or
+// the Tier-1 localhost stack).
+import { test as base, expect } from '@playwright/test'
+
+const CONSENT = JSON.stringify({
+  essential: true,
+  analytics: false,
+  other: false,
+  recorded_at: '2000-01-01T00:00:00.000Z',
+})
+
+export const test = base.extend({
+  context: async ({ context }, use) => {
+    await context.addInitScript((value) => {
+      try {
+        window.localStorage.setItem('rfc-app.cookie-consent.v1', value)
+      } catch {
+        // localStorage unavailable — fall back to lib/ui.js dismissCookies.
+      }
+    }, CONSENT)
+    await use(context)
+  },
+})
+
+export { expect }