delivery-kid: snapshot draft diagnostics to wiki sub-page

[AudioSkyWalker]

Summary

Mirrors each content draft's upload_log / finalize_log / preview_log to a ReleaseDraft:{id}/diagnostics wiki sub-page at every terminal-state transition, so the diagnostics history surfaced by cryptograss/pickipedia#81 survives a delivery-kid storage rebuild instead of going down with draft.json.

Reuses the Magent@magent BotPassword already provisioned for the Blue Railroad import tool — no new bot account needed (per Justin's call on the PR thread). Same PICKIPEDIA_BOT_USER / PICKIPEDIA_BOT_PASSWORD env vars Hunter container_startup.py already references.

What's in here

• pinning-service/app/services/pickipedia_client.py — new module. mwclient-based wiki write helper, lazy-init Site singleton (lock-guarded for concurrent webhook callers), no-ops cleanly when the password env var is unset (so dev environments without bot creds still run).
• Hook points at the four terminal states, all asyncio.create_task fire-and-forget so a wiki blip never blocks the route or masks the underlying upload outcome:
  • routes/content.py fail() → upload_failed
  • routes/content.py _submit_preview_transcode exception path → preview_status: failed before Coconut even ran
  • routes/content.py finalize_sse_generator finally → finalized + finalize_failed (snapshots BEFORE the rmtree on success, since state is the only copy of finalize_log once we wipe draft.json)
  • routes/coconut.py _update_draft_preview → preview_status: ready + failed (after webhook resolves the Coconut job)
• requirements.txt — add mwclient>=0.10.1 (same pin as blue-railroad-import)
• ansible/playbook.yml — surface PICKIPEDIA_URL / PICKIPEDIA_BOT_USER / PICKIPEDIA_BOT_PASSWORD to the pinning-service container with sensible defaults
• Tests — 14 cases in tests/test_pickipedia_client.py covering creds-missing short-circuit, login-failure handling, lazy-init caching, sub-page title format, unchanged-content no-op, save-exception swallow, and the dict-based variant for the Coconut webhook path. Existing 20 tests still pass (pytest tests/ → 34 passed).

Test plan

• Deploy with PICKIPEDIA_BOT_PASSWORD set in the vault — upload a video that fails ffprobe, confirm ReleaseDraft:{uuid}/diagnostics gets created with status: upload_failed + the upload_log JSON
• Trigger a finalize that succeeds — confirm the sub-page is updated with status: finalized + the finalize_log even after the source draft.json is rmtree'd
• Trigger a Coconut preview transcode webhook (both success + failure paths) — confirm sub-page reflects preview_status: ready / failed with preview_log populated
• Run the wiki-side fallback path: simulate delivery-kid forgetting a draft, confirm pickipedia#81's initDiagnostics falls back to the snapshot and renders with the "(snapshot)" disclosure label

Related

• cryptograss/pickipedia#81 — wiki side: diagnostics panel + the JS fallback that consumes this sub-page

[magent-cryptograss]

Superseded by #87.

Rebased onto current production (91f0f7a) and re-targeted from magent-cryptograss/maybelle-config per the standing fork policy. Single commit, Sky's authorship preserved.

The routes/content.py conflict was an additive collision with production's log_pre_handler_failure (accf8cd). Resolved by keeping both helpers, sequenced. Other 3 hunks (call sites) auto-merged cleanly.

Pair with cryptograss/pickipedia#82 for the wiki-side rendering. Safe to close this one whenever you're back at a keyboard.