fix(ajax): show the reference skeleton on every load-more surface

Clicking 加载更多 in the 多栏目文章 widget showed no skeleton at all — the
list simply stayed still until the response arrived, then the new cards
appeared. The homepage stream, archives and comments already had a working
skeleton; the widget's AJAX load goes through a different client and never
found its loader.

Root cause was DOM placement, not visibility: ContentRenderer emitted
.post_ajax_loader as a *sibling* of .widget-ajaxpager, while the widget REST
client resolves it with container.querySelector('.post_ajax_loader'). The
node existed but could never match, so .is-loading was never added and the
skeleton stayed display:none. Inactive tab panes had the same shape, and the
direct-load branch of ajaxpager() emitted no loader at all.

Changes, all following the reference theme's post_ajax() contract in
zibll/js/main.js (beforeSend anchors the loader to the end of the list;
success only hides it, never removes it):

- ContentRenderer: nest the loader inside .widget-ajaxpager for both the
  direct-load and inactive-tab branches, and drop the sibling append.
- widgets/frontend.js: anchorLoader() moves the loader to the end of the
  list before .ajax-pag on every request; appended cards are inserted before
  it; a replace preserves the node instead of wiping it with innerHTML; a
  fallback loader is created when the DOM has none; loadItems() now returns
  its promise; drop the unreachable is-loading auto-load branch.
- Message centre, user-home panels and the search page switch from spinner /
  opacity feedback to the same .posts-item-shaped skeleton, so all AJAX
  surfaces share one loading contract.
- Remove the second, never-wired skeleton system (.aksrt-skeleton-* in
  core-ui.css) and the dead spinner stylesheets/rules (skeleton.css,
  ajax-spinner.css, .load-more__*, --skeleton-base/--skeleton-shine) plus the
  unregistered assets/js/waterfall.js.
- Extend the widget, message-centre, user-home and asset-ledger contract
  tests to pin the loader inside the container, the class-only visibility
  switch, and the absence of the deleted dead code.

Verified: 470 node tests, 136 PHP widget assertions, admin-contract and
widget-system audits all green; rebuilt public assets after the CSS/JS
removals.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/widget-system/post-visual-contract.test.cjs

@@ -44,6 +44,11 @@ test('the article stream exposes only the new typed renderer contract', () => {
   assert.doesNotMatch(consumers, /function_exists\(['"]aksrt_render_post_list/);
   assert.doesNotMatch(consumers, /aksrt_render_post_list\(\s*\$query\s*,/);
   assert.doesNotMatch(consumers, /content-post-card|aksrt_homepage_render_post_card/);
+
+  // 搜索页的加载态必须是文章同构骨架，而不是遗留的转圈 spinner，
+  // 这样 runtime main.js 的 list 型 loader 形状才与搜索结果一致。
+  assert.match(read('search.php'), /post_ajax_loader search-loader"><\?php echo function_exists\('aksrt_render_placeholder'\) \? aksrt_render_placeholder\('list', 6\)/);
+  assert.doesNotMatch(read('search.php'), /class="loading mr10"/);
 });
 
 test('settings use legacy list modes, grouped options, and destructive related keys', () => {
@@ -224,6 +229,8 @@ test('related posts, author page and widgets use their dedicated renderers', ()
   const relatedCard = read('inc/helpers/aksrt-single-components.php');
   const resourceRelated = read('templates/parts/resource-related.php');
   const author = read('templates/parts/user-home/panel-posts.php');
+  const authorFavorites = read('templates/parts/user-home/panel-favorites.php');
+  const userHomeCss = read('assets/css/routes/user-home.css');
   const widgets = read('src/WidgetSystem/PostRenderer.php');
 
   assert.match(related, /\['img', 'list', 'text'\]/);
@@ -249,6 +256,14 @@ test('related posts, author page and widgets use their dedicated renderers', ()
   assert.match(author, /'wrapper_class'\s*=>\s*'aksrt-user-home__post-list'/);
   assert.match(author, /aksrt_render_user_home_pagination\(\(int\) \$author_posts->max_num_pages, \(int\) \$posts_page\)/);
   assert.doesNotMatch(author, /aksrt_render_pagination|aksrt_render_profile_pagination|\$_GET|add_query_arg/);
+  // 面板 AJAX 翻页的骨架：与文章列表同一个 .post_ajax_loader 契约，
+  // 由 author.js 的 .is-loading 切换（不能再靠 opacity 变暗反馈）。
+  assert.match(author, /'append_inner_html' => \$user_home_panel_loader/);
+  assert.match(author, /aksrt_render_placeholder\('list', max\(4, \(int\) \$per_page\)\)/);
+  assert.match(authorFavorites, /'append_inner_html' => \$user_home_panel_loader/);
+  assert.match(userHomeCss, /\.aksrt-user-home \.dashboard-panel \.post_ajax_loader \{/);
+  assert.match(userHomeCss, /\.aksrt-user-home \.dashboard-panel\.is-loading \.post_ajax_loader \{/);
+  assert.doesNotMatch(userHomeCss, /\.dashboard-panel\.is-loading \{[\s\S]{0,80}opacity: \.6/);
   assert.match(widgets, /aksrt_render_mini_list/);
   assert.match(widgets, /swiper-container swiper-scroll/);
 });
@@ -454,7 +469,9 @@ test('profile routes load versioned leaf styles and keep dialogs hidden initiall
   assert.doesNotMatch(panelFavorites, /'type'\s*=>\s*'list'/);
   assert.match(panelFavorites, /'context'\s*=>\s*'author'/);
   assert.match(panelFavorites, /aksrt_render_user_home_pagination\(\(int\) \$favorites_query->max_num_pages, \(int\) \$favorites_page\)/);
-  assert.match(panelFavorites, /array_merge\(\$user_home_render_config, \['wrapper_class' => 'aksrt-user-home__post-list'\]\), \$favorites_query\)/);
+  assert.match(panelFavorites, /array_merge\(\$user_home_render_config, \['wrapper_class' => 'aksrt-user-home__post-list', 'append_inner_html' => \$user_home_panel_loader\]\), \$favorites_query\)/);
+  assert.match(panelFavorites, /aksrt_render_placeholder\('list', max\(4, \(int\) \$per_page\)\)/);
+  assert.match(read('templates/parts/user-home/panel-posts.php'), /array_merge\(\$user_home_render_config, \['wrapper_class' => 'aksrt-user-home__post-list', 'append_inner_html' => \$user_home_panel_loader\]\), \$author_posts\)/);
   assert.doesNotMatch(panelFavorites, /profile-list-item|\$_GET|add_query_arg/);
   // Only the two-column user center spans the viewport; the single-column public
   // profile keeps following the admin content max width.