docs(screenshots): replace v1.0.0 Splunkbase asset set (privacy + professionalism)

User asset audit (2026-05-25) flagged two material problems with the
previously-committed build-669 screenshots that would have been
embarrassing if uploaded to Splunkbase:

1. PRIVACY -- screenshots 03 (audit-trail), 04 (inline-editing), and
   05 (control-panel-activity) all included the Splunk Enterprise
   dev-license banner at the top of the page, which prominently
   displays the maintainer's personal email address. This is a
   public-launch privacy leak.

2. PROFESSIONALISM -- 02 (control-panel-approval-queue) was dominated
   by E2E stress-test artifacts: `MILLIONROWCONTENT_xxx` rule names
   with 87-character repeated 'a' patterns, "Stress test reason for
   long content..." comments filling both Pending Requests and
   Recent History. Unusable as a marketing screenshot.

Additional minor issues caught:
- Screenshots 01 + 04 included a leftover empty `TestCol` column
  (test artifact, not a real schema field).
- Screenshot 05 showed only the built-in `admin` user with 4 small
  counters and a large empty area below; not representative of the
  multi-analyst workflow the app exists to support.

Remediation pipeline:
- Curated container state via production REST APIs (analyst1/analyst2/
  superadmin1/wladmin1 doing realistic row adds, edits, and approval-
  request submissions) so the Activity and Approval Queue tabs render
  with believable content. Approval queue purge required one
  `# JUSTIFIED:` bash override (per the synthetic-fixture hook spec)
  because the production `process_approval` endpoint returned 500 on
  the malformed `DR_WLLONGCONTENT_aaa...` rule names trapped in the
  queue from prior E2E runs.
- Removed TestCol from DR55_brute_force_users via the production
  `save_csv` action (proper column-removal audit event emitted).
- Captured all 5 screenshots via playwright-iso at 1440x900 viewport
  with the Splunk top bar mechanically hidden (`[class*=navBar---]`
  display:none) so the screenshot starts at the app's own nav line
  (Whitelist Manager | Audit Trail | Control Panel). This eliminates
  the DEVLICENSE banner by crop, not by trying to suppress the dev
  license itself.

Bonus: screenshot 04 (now on DR130_privilege_escalation, not DR55) also
shows the pending-approval banner with live Approve/Reject buttons,
which demonstrates the dual-admin approval workflow far better than
the previous DR55-duplicate-of-01 version did.

Prep script gitignored at scripts/screenshot_prep.py (it's one-shot
asset prep, not CI-gated; see docstring for the why).

Legacy May-6 screenshots (01-main-dashboard.png, 02-inline-editing.png,
03-audit-trail.png, 04-control-panel.png) remain on disk as
PRE_PUBLIC_AUDIT.md F-L11 audit evidence per the active/historical
split documented in docs/PUBLIC_FILE_INVENTORY.md.

Author: RelativisticJet

.gitignore

@@ -193,3 +193,4 @@ entities.json
 # removed 3 unrelated career-page scrapes that had been accidentally
 # tracked (2026-05-18).
 .firecrawl/
+scripts/screenshot_prep.py