ci(nightly): repair five job classes broken by the #649 QA hardening (#695)

Nightly has been red since 07-28; per-PR CI and main are green. Two investigations traced all five failing classes to #649: extended-matrix required AI bundles it never installs (removed), nightly SYSTEM_DEPS drifted from ci.yml (added libreoffice + a doc-binaries composite for pandoc/pdfcpu), the generated-case classifier only skipped ffmpeg (widened to pdfcpu/soffice/pandoc + excluded repo-audit specs from the lean docker image), a settings spec capped loginAttemptLimit and 429-cascaded the serial bucket (restore via API), and type-to-search refused keystrokes under a route announcer's programmatic focus (guard added). A nightly dispatch on the branch confirmed all five classes green.

tests/unit/shared/type-to-search.test.ts

@@ -225,6 +225,45 @@ describe("isSearchBoxTypeable", () => {
     expect(isSearchBoxTypeable(input, d)).toBe(true);
   });
 
+  // A route announcer parks focus on a heading (tabindex="-1") to move the
+  // screen-reader reading position after a client-side navigation. That focus
+  // is programmatic and non-editable, so type-to-search must still work.
+  it("accepts when a route-announcer heading holds the reading position", () => {
+    const input = box();
+    const heading = {
+      tagName: "H1",
+      isContentEditable: false,
+      getAttribute: (name: string) => (name === "tabindex" ? "-1" : null),
+    };
+    const d = doc({ activeElement: heading, elementFromPoint: () => input });
+
+    expect(isSearchBoxTypeable(input, d)).toBe(true);
+  });
+
+  it("still rejects a real focused input even when it has tabindex -1", () => {
+    const focused = {
+      tagName: "INPUT",
+      isContentEditable: false,
+      getAttribute: (name: string) => (name === "tabindex" ? "-1" : null),
+    };
+    const input = box();
+    const d = doc({ activeElement: focused, elementFromPoint: () => input });
+
+    expect(isSearchBoxTypeable(input, d)).toBe(false);
+  });
+
+  it("still rejects a contenteditable region even at tabindex -1", () => {
+    const editable = {
+      tagName: "DIV",
+      isContentEditable: true,
+      getAttribute: (name: string) => (name === "tabindex" ? "-1" : null),
+    };
+    const input = box();
+    const d = doc({ activeElement: editable, elementFromPoint: () => input });
+
+    expect(isSearchBoxTypeable(input, d)).toBe(false);
+  });
+
   it("rejects a zero-width box, which is how a hidden element measures", () => {
     const input = box([], { width: 0 });
     const d = doc({ elementFromPoint: () => input });