#245: mode hidden — hide profile-violating options, mark the hiding

In hidden (and later enforced) mode, catalog-listed controls whose only
purpose is enabling a violation are not rendered while their saved value
is compliant (the four master switches, the Nextcloud backup block);
value-listed selects keep only their compliant choices (registration
mode, new-page classification, upload policy, SVG policy). Every
affected section shows one accessible policy note (i18n de+en) so
policy is distinguishable from missing features. A value that was
already violating is surfaced exactly like in marked — never silently
hidden. The API stays unchanged; enforcement is #246. e2e: hidden half
of the marking pack (rows disappear, note visible, already-violating
row stays marked, axe WCAG A/AA clean) — verified live locally; CI runs
it against a second api (VS_NFD_MODE=hidden, same database) behind its
own static server.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AUtYMxwTCMHG9mVHnwbFg8

apps/web/e2e/vs-nfd-marking.spec.ts

@@ -58,10 +58,16 @@ test('mode hidden: rows disappear, notes mark the hiding, a11y clean', async ({
   // hidden — the row stays visible with its marking.
   await expect(page.locator('#vs-nfd-mark-feeds\\.enabled')).toBeVisible();
 
-  // api.enabled/mcp.enabled default to false = compliant: their rows
-  // disappear (2 of 4 master-switch rows remain) and the section carries
-  // the accessible policy note.
-  await expect(page.locator('.api-opt-in__label')).toHaveCount(2);
+  // Master switches: compliant (false) rows disappear, violating (true)
+  // rows stay — derive the expectation from the actual instance settings,
+  // the seed state differs between local and CI databases.
+  const settings = (await (
+    await context.request.get(`${BASE_URL}/api/v1/admin/settings`)
+  ).json()) as Record<string, boolean>;
+  const masterKeys = ['api.enabled', 'mcp.enabled', 'feeds.enabled', 'plugins.enabled'] as const;
+  const visible = masterKeys.filter((key) => settings[key] === true).length;
+  expect(visible).toBeLessThan(masterKeys.length); // at least one row is hidden
+  await expect(page.locator('.api-opt-in__label')).toHaveCount(visible);
   await expect(page.locator('.vs-nfd-hidden-note').first()).toBeVisible();
 
   // Value-listed control: the compliant registration mode keeps only its