feat(integration): add image variants section and standardize code snippets

features/integration.qa.md

@@ -4,7 +4,7 @@
 
 Mount IntegrationPage inside DashboardShell with a resolved verified session and a test router at
 /integration. Stub `window.location.origin` to `https://cms.renew.example` (the board's sample) and
-`navigator.clipboard.writeText` per case. No `/v1` mocks are needed. A spec fails if any `/v1` call
+`navigator.clipboard.writeText` per case. Mock only GET /v1/image-variants (see integration_images.qa.md). A spec fails if any other `/v1` call
 is made.
 
 Catalogue spec (pure data, no mount, imports web/src/data/apiCatalogue.ts):
@@ -44,12 +44,12 @@ Component specs, one per design state:
    invite rows show "Owner only".
 2. **Group scrolled, one card expanded**: click the POST /v1/article/ row. Assert the Query
    parameters table above the Request body table, the body rows, tabs fetch/curl/Response with fetch
-   active, the "JavaScript" CodeBlock, and the Errors list with 400 and 401.
+   active in one CodeSnippet, and the Errors list with 400 and 401.
 3. **Copied: base URL**: fake timers; click Copy. Clipboard gets the origin; check icon and "Copied";
    announced; reverts after 2 s.
-4. **Copied: CodeBlock**: expand a card; click "Copy JavaScript example". Clipboard gets that code,
+4. **Copied: CodeSnippet**: expand a card; click "Copy code". Clipboard gets the active tab's code,
    only that button reads "Copied", and it reverts after 2 s.
-5. **Authentication**: both cards, curl/fetch tabs for GET /v1/auth/me, the "Manage API keys" link
+5. **Authentication**: both cards, a CodeSnippet with curl/fetch tabs for GET /v1/auth/me, the "Manage API keys" link
    href /integration/api-keys, Note 1, Note 2.
 6. **Session only**: the corrected banner; lock icon and "Session only" chip only on rows that
    answer 403; the caption on the login family; no expand control; the "Public auth flow" rows with
@@ -61,6 +61,7 @@ Component specs, one per design state:
 9. **Tabs**: curl and Response render for a card. curl contains the stubbed origin and the
    Authorization header only on non-public routes. Not visually checked.
 10. **Notes**: format note, image-prefix note, CORS note.
+11. **Base URL and error sample**: both are CodeSnippets (single tabs "Base URL" and "Error response · text/plain").
 
 ## Visual (`task visual:check -- integration`, desktop and mobile, light and dark)
 
@@ -78,7 +79,7 @@ diff, sets the smallest `maxPercent` that is sufficient, writes the reason, and
 - [ ] Default (exception: owner-only chips and rate-limit line)
 - [ ] Group scrolled, one card expanded (exception: Query parameters table)
 - [ ] Copied: base URL (must pass 10 %)
-- [ ] Copied: CodeBlock (must pass 10 %)
+- [ ] Copied: CodeSnippet (must pass 10 %)
 - [ ] Authentication (must pass 10 %; Note 1 text changed)
 - [ ] Session only (exception: banner, 13th row, captions, Public auth flow block)
 - [ ] Errors (exception: 409 row)
@@ -88,7 +89,7 @@ None of these states is clock-sensitive, so none is skipped.
 
 ## Manual
 - Keyboard and focus order: index, Base URL Copy, each row (Enter/Space), tab strip (arrow keys),
-  CodeBlock Copy, the pre (tabindex 0), Jump to on mobile.
+  CodeSnippet Copy, the pre (tabindex 0), Jump to on mobile.
 - Hover and motion on ghost Copy buttons and rows.
 - Find-in-page and a deep link to an `#ep-...` anchor.
 - Real origin in a production build and under `task dev`.