fix(web): retire the stale homelab-era copy — neutral, accurate defaults on every page

Fixed: index.html meta description, empty-state sub and composer
placeholder (A1); app/config.py default suggestion chips → the four
neutral A2 defaults (BOR_SUGGESTIONS override unchanged); sources.html
KB page-sub → the current source model (git repos + local dirs +
uploaded archives, Sync pulls/imports); git-sources.html example URL
→ your-repo.git (A3); all 9 footers → neutral default in
span.footer-text (the phase-62 hook); E2E/unit conftests force the
code defaults so a local .env cannot leak corpus copy into tests;
new unit text pins + dedicated E2E suite.

Task 02 verification read-through — no change needed:
- sources.html sync result/error copy (matches the real sync behavior)
- tuning.html page-sub (accurate as written)
- history.html page-sub (accurate as written)
- doc-edit.html page-sub (accurate as written)
- git-sources.html page-sub (accurate as written)
- #sources-gate anonymous copy (accurate as written)

tests/e2e/conftest.py

@@ -14,6 +14,7 @@ Prerequisite for story tests that touch the database:
 """
 from __future__ import annotations
 
+import json
 import os
 import subprocess
 import sys
@@ -25,6 +26,8 @@ import httpx
 import pytest
 from playwright.sync_api import Browser, Page, sync_playwright
 
+from app.config import Settings as _Settings
+
 REPO = Path(__file__).resolve().parents[2]
 APP_PORT = int(os.environ.get("E2E_APP_PORT", "8123"))
 MOCK_PORT = int(os.environ.get("E2E_MOCK_PORT", "8901"))
@@ -99,6 +102,16 @@ def app_server(mock_llm: int) -> Iterator[str]:
     # Phase 16: admin auth must be set or create_app() refuses to boot.
     env["BOR_ADMIN_PASSWORD"] = ADMIN_PASSWORD
     env["BOR_SESSION_SECRET"] = SESSION_SECRET
+    # Phase 61 (defect fix): force the code DEFAULTS so an operator's local
+    # (gitignored) ``.env`` — loaded by pydantic-settings from ``cwd=REPO``
+    # — cannot leak corpus-specific chips / a docs repo into the app under
+    # test: process env ranks above the ``.env`` file. The suggestions
+    # default is derived from the class field (never drifts from
+    # ``app/config.py``); docs-push stays inert (empty repo).
+    env["BOR_DOCS_REPO"] = ""
+    env["BOR_SUGGESTIONS"] = json.dumps(
+        _Settings.model_fields["suggestions"].default
+    )
     proc = subprocess.Popen(
         [sys.executable, "-m", "uvicorn", "app.main:app",
          "--host", "127.0.0.1", "--port", str(APP_PORT), "--log-level", "warning"],