feat(integration): add image variants section and standardize code snippets

features/integration.feature

@@ -7,7 +7,7 @@ Feature: Integration screen (API reference)
   Background:
     Given /integration is a verified route (meta.auth "verified") rendered as IntegrationPage
       inside DashboardShell, per docs/design/routes.md
-    And the screen makes no /v1 calls; api: none (static)
+    And the screen makes one call, GET /v1/image-variants, for owner and admin sessions only (features/integration_images.feature)
     And the PageHeader shows breadcrumb "Integration", title "API reference" and description
       "Everything a developer needs to build on RenewCMS."
     And the endpoint catalogue is a typed static data file at web/src/data/apiCatalogue.ts, and the view only renders it
@@ -37,7 +37,7 @@ Feature: Integration screen (API reference)
   Scenario: Default, every card collapsed
     When the user navigates to /integration
     Then the intro reads "RenewCMS is headless: it stores your content and your own code displays it. There are two ways in. Public read-only access lets a website read online articles. API keys let a script or service manage articles, media and users without the back-office."
-    And a "Base URL" row shows window.location.origin in a monospace box with a "Copy" button (icon copy)
+    And a "Base URL" label sits above a CodeSnippet with the single tab "Base URL" showing window.location.origin and a "Copy" button (icon copy)
     And every EndpointCard is collapsed as a 44 px row: method badge, mono path, one-line description, chips, chevron
     And the sticky section index lists the sections on desktop and a "Jump to" select lists them on mobile
 
@@ -70,7 +70,7 @@ Feature: Integration screen (API reference)
       | Name  | Type   | Required | Rule                                         |
       | title | string | Yes      | 3 to 200 characters. Can't be changed later. |
       | body  | string | No       | No length limit.                             |
-    And tabs fetch, curl and Response show, fetch active, with a CodeBlock labelled "JavaScript" and a ghost "Copy" button
+    And one CodeSnippet with the tabs fetch, curl and Response shows, fetch active, with a "Copy" button
     And an "Errors" list shows a status chip with a one-line caption for 400, 401
 
   Scenario: Query parameters table, new UI beyond the board, user-approved
@@ -114,7 +114,7 @@ Feature: Integration screen (API reference)
   Scenario: Authentication section
     Then card "Public" reads "No key needed. Two read-only routes, and only online articles are returned." and names GET /v1/article/ and GET /v1/article/{id}
     And card "API key" reads "Send `Authorization: Bearer rcms_…`. Requests act as the user who created the key, with that user's role (owner or admin). A key never has more rights than its creator."
-    And its CodeBlock has tabs curl and fetch for GET /v1/auth/me, using the current origin
+    And its CodeSnippet has tabs curl and fetch for GET /v1/auth/me, using the current origin
     And it says "Keys start with `rcms_` and are shown in full once, when you create them."
     And a "Manage API keys" link navigates to /integration/api-keys
     And Note 1 reads "A key can't create, list or revoke API keys, verify or cancel a registration, or call anything under `/v1/system`. Those routes answer 403 "This action needs a real session." An invalid, unknown, expired or revoked key answers 401, even on public routes, and so does a key whose user was deleted or unverified."
@@ -139,7 +139,7 @@ Feature: Integration screen (API reference)
       | 409    | There's already a pending invite for this address. / This invite has already been accepted. |
       | 429    | Too many requests. Please try again later. |
       | 500    | Internal server error |
-    And a sample shows "HTTP/1.1 403 Forbidden", "Content-Type: text/plain", a blank line, and "This action needs a real session."
+    And a CodeSnippet with the single tab "Error response · text/plain" shows "HTTP/1.1 403 Forbidden", "Content-Type: text/plain", a blank line, and "This action needs a real session."
     And the table does not use the SPA copy of docs/design/states.md
 
   Scenario Outline: Per-endpoint error captions use the real strings
@@ -169,15 +169,15 @@ Feature: Integration screen (API reference)
     Given the app is served from origin "{origin}"
     When the user activates the Base URL "Copy" button
     Then "{origin}" is written to the clipboard
-    And the button shows icon check and "Copied", announced to assistive technology
+    And the button, named "Copy code", shows icon check and "Copied", announced politely
     When 2 seconds elapse
     Then the button reverts to icon copy and "Copy"
 
-  Scenario: Copied, CodeBlock is independent of Base URL
+  Scenario: Copied, CodeSnippet is independent of Base URL
     Given a card is expanded
-    When the user activates that CodeBlock's "Copy JavaScript example" button
-    Then that card's exact code string is written to the clipboard and only that button reads "Copied"
-    And the Base URL button and other CodeBlocks are unaffected
+    When the user activates that CodeSnippet's "Copy code" button
+    Then the active tab's exact code string is written to the clipboard and only that button reads "Copied"
+    And the Base URL button and other CodeSnippets are unaffected
 
   Scenario: Examples use the current origin and the API key header
     Then every fetch and curl example starts from "{origin}" and carries no ?format= query
@@ -189,5 +189,7 @@ Feature: Integration screen (API reference)
     Then the page scrolls to that anchor and the item reports aria-current "true"
     And on mobile the "Jump to" select opens and lists the same sections
 
-  Scenario: The page stays static
-    Then no /v1 request is made while the page renders or while any card is expanded
+  Scenario: Only the image variants calls
+    Then the only /v1 request is GET /v1/image-variants, sent for owner and admin sessions on mount, on "Try again" and on window focus
+    And expanding or collapsing any card makes no /v1 request
+    And a session that is neither owner nor admin makes no /v1 request