QA gate + functionality catalog

[vapvarun]

Docs/QA only — no runtime PHP/JS/CSS changed.

What's added

• audit/manifest.json — functionality catalog mirroring the Wbcom v2 manifest schema: options (loader type/colours/icon), the public unauthenticated read endpoint on template_redirect (infinite_loader_ajax=1) with its response headers, the 30/min per-IP rate limiter, archive security headers, settings + sanitizers, admin surfaces, ~18 filter/action seams, and the bundled FA5 Free assets. No REST / cron / tables / shortcodes / blocks (recorded as empty).
• CAPABILITIES.md — capability roll-up with maturity per capability, admin surfaces (settings tabs + icon picker), the frontend infinite-scroll / Load More archive surface, data stored (options), FA5 icon assets enqueued, extension seams, and the security layer on the public read endpoint.
• docs/qa/QA-GATE.md — filled gate, all 8 phases + code-flow items retained; browser phases (03 admin, 04 frontend) and the friction hunt (07) rewritten against the real surfaces — the icon picker rendering/selecting, next-page AJAX append on a generic theme, loader icon matching the pick, running result count, address-bar tracking, 2000+ product scale, one-thumb 390px, and infinite-scroll a11y (focus not trapped, footer still reachable).

Verified from source at a1d71c8 (branch master). Do not merge — review artifact.