fix(ajax): show the reference skeleton on every load-more surface

Clicking 加载更多 in the 多栏目文章 widget showed no skeleton at all — the
list simply stayed still until the response arrived, then the new cards
appeared. The homepage stream, archives and comments already had a working
skeleton; the widget's AJAX load goes through a different client and never
found its loader.

Root cause was DOM placement, not visibility: ContentRenderer emitted
.post_ajax_loader as a *sibling* of .widget-ajaxpager, while the widget REST
client resolves it with container.querySelector('.post_ajax_loader'). The
node existed but could never match, so .is-loading was never added and the
skeleton stayed display:none. Inactive tab panes had the same shape, and the
direct-load branch of ajaxpager() emitted no loader at all.

Changes, all following the reference theme's post_ajax() contract in
zibll/js/main.js (beforeSend anchors the loader to the end of the list;
success only hides it, never removes it):

- ContentRenderer: nest the loader inside .widget-ajaxpager for both the
  direct-load and inactive-tab branches, and drop the sibling append.
- widgets/frontend.js: anchorLoader() moves the loader to the end of the
  list before .ajax-pag on every request; appended cards are inserted before
  it; a replace preserves the node instead of wiping it with innerHTML; a
  fallback loader is created when the DOM has none; loadItems() now returns
  its promise; drop the unreachable is-loading auto-load branch.
- Message centre, user-home panels and the search page switch from spinner /
  opacity feedback to the same .posts-item-shaped skeleton, so all AJAX
  surfaces share one loading contract.
- Remove the second, never-wired skeleton system (.aksrt-skeleton-* in
  core-ui.css) and the dead spinner stylesheets/rules (skeleton.css,
  ajax-spinner.css, .load-more__*, --skeleton-base/--skeleton-shine) plus the
  unregistered assets/js/waterfall.js.
- Extend the widget, message-centre, user-home and asset-ledger contract
  tests to pin the loader inside the container, the class-only visibility
  switch, and the absence of the deleted dead code.

Verified: 470 node tests, 136 PHP widget assertions, admin-contract and
widget-system audits all green; rebuilt public assets after the CSS/JS
removals.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/widget-system/asset-ledger-contract.test.cjs

@@ -60,6 +60,38 @@ test('old asset implementations and compatibility aliases are absent', () => {
   assert.deepEqual(violations, [])
 })
 
+test('skeleton loading ships one contract and no dead spinner stylesheets', () => {
+  // The skeleton contract is the shared .placeholder block inside a
+  // .post_ajax_loader wrapper. The standalone helpers below were never wired
+  // to any producer and were removed; they must not come back as a second path.
+  for (const removed of [
+    'assets/css/frontend/skeleton.css',
+    'assets/css/frontend/ajax-spinner.css',
+    'assets/js/waterfall.js',
+  ]) {
+    assert.equal(fs.existsSync(path.join(root, removed)), false, `${removed} must stay deleted`)
+  }
+
+  const build = fs.readFileSync(path.join(root, 'tools', 'build-public-assets.mjs'), 'utf8')
+  for (const dropped of ['skeleton.css', 'ajax-spinner.css']) {
+    assert.doesNotMatch(build, new RegExp(dropped.replace('.', '\\.')))
+  }
+
+  // Dead rule families with no producer in PHP or JS.
+  const css = sourceFiles(path.join(root, 'assets', 'css'))
+    .filter((f) => !f.includes('build') && !f.endsWith('.min.css'))
+  for (const file of css) {
+    const text = fs.readFileSync(file, 'utf8')
+    assert.doesNotMatch(text, /\.load-more__(?:btn|spinner)/, `${path.relative(root, file)} must not reintroduce .load-more__*`)
+    assert.doesNotMatch(text, /\.aksrt-loading__(?:spinner|overlay|inline|text|dot)/, `${path.relative(root, file)} must not reintroduce .aksrt-loading__*`)
+    assert.doesNotMatch(text, /aksrt-progress-bar/, `${path.relative(root, file)} must not reintroduce .aksrt-progress-bar`)
+    // A second parallel skeleton system (never wired to any producer).
+    assert.doesNotMatch(text, /\.aksrt-skeleton/, `${path.relative(root, file)} must not reintroduce .aksrt-skeleton-*`)
+    assert.doesNotMatch(text, /aksrt-skeleton-shimmer/, `${path.relative(root, file)} must not reintroduce the parallel shimmer keyframes`)
+    assert.doesNotMatch(text, /--skeleton-(?:base|shine)/, `${path.relative(root, file)} must not reintroduce the unused skeleton tokens`)
+  }
+})
+
 test('asset tables are InnoDB and operation keys are unique', () => {
   const schema = fs.readFileSync(path.join(root, 'src', 'Core', 'DBMigratorPart2.php'), 'utf8')
   for (const table of ['asset_account', 'asset_transaction', 'asset_entry']) {