shopping: multi-list, DnD ordering, phone layout; fix flaky tests

Shopping lists:
  - Multiple lists per tenant: picker uses checkboxes instead of
    radios. Relay schema migrated to composite PK (tenant_id,
    card_uid) with a position column for display ordering.
  - Picker rows are drag-and-drop reorderable (grip handle +
    accent drop indicator). Order persists in localStorage and is
    pushed to the relay as position integers — phone renders lists
    in that order (ORDER BY position, title).
  - Each picker row has a goto-arrow that closes the popup,
    switches to the card's bucket if needed, and opens the card.
  - Relay DELETE /api/shopping removes deactivated lists. Client
    proxy forwards DELETE. Deactivating a list in the picker
    immediately removes it from the relay.
  - Phone UI renders multiple lists as stacked boxes with headers.
    Section headings (# h1–h6) get 14px top padding for breathing
    room. CSS selectors fixed to match div-based headings inside
    the new .shopping-list-box containers.
  - Help text updated for multi-list wording.
  - pullOne preserves the synced position so a pull doesn't cause
    a spurious re-push of the same order.

Test fixes:
  - Line-numbers gutter height tolerance bumped 50%→60% — OS text
    shaping can push the divergence past 50%.
  - Find/replace flaky: replaced sleep(200) with waitFor on the
    confirm dialog so slow renders don't miss the OK click.
  - Shopping picker test updated: checkboxes instead of radios.

Bumps to 1.9.25.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

public/plugins/tests/board-find-replace.test.js

@@ -1,4 +1,4 @@
-import { describe, it, afterEach, expect, $, $$, click, sleep, closeAll, csrf } from './runner.js?v=4';
+import { describe, it, afterEach, expect, $, $$, click, sleep, waitFor, closeAll, csrf } from './runner.js?v=4';
 
 async function makeCard(title, body) {
     return fetch('api/cards', {
@@ -70,13 +70,13 @@ describe('Search: Find/Replace', () => {
         const applyBtn = document.getElementById('search-replace-all');
         expect(applyBtn.disabled).toBe(false);
         click(applyBtn);
-        await sleep(200);
 
-        const dialog = document.getElementById('dialog');
-        if (dialog?.classList.contains('open')) {
-            const okBtn = document.getElementById('dialog-ok');
-            if (okBtn) click(okBtn);
-        }
+        // The replace-all button opens a confirm dialog — wait for it
+        // to appear rather than relying on a fixed sleep, since the
+        // dialog creation is async and can lag on slow runs.
+        await waitFor(() => document.getElementById('dialog')?.classList.contains('open'), 2000);
+        const okBtn = document.getElementById('dialog-ok');
+        if (okBtn) click(okBtn);
 
         // Poll until the replace has actually persisted
         let updated1, updated2;