docs(lanes): document proof gallery (C)

docs/API.md

@@ -467,6 +467,87 @@ Response: `{ "lane": <same shape GET /api/lanes/:id returns>, "feature": <same s
 - **404** `{ "error": { "code": "ENOLANE", "message": "lane not found" } }`.
 
 
+#### Lane proof gallery
+
+Proof gallery (QC screenshots) captured at `<lane.cwd>/.playwright-mcp/proof/<slug>/<phase-group>/` and grouped by feature slug (the same slug from per-feature state). Read-only access and deletion are path-contained: every proof file is resolved, realpath'd, and checked to be inside the lane's proof root before serving or deleting.
+
+```http
+GET /api/lanes/:id/proof
+```
+
+List every feature with proof (or an activated-but-not-yet-shot feature from `lane_features`), most recently touched first:
+
+```json
+{
+  "features": [
+    {
+      "slug": "auth-redesign",
+      "groups": {
+        "desktop": ["01-login.png", "02-signup.png"],
+        "mobile": ["01-login.png"]
+      },
+      "ticket_report": "auth-redesign/ticket/REPORT.html",
+      "mtime": 1722755400
+    }
+  ]
+}
+```
+
+Each feature has:
+- **`slug`** (string) — canonicalized feature slug
+- **`groups`** (object) — `{ "phase": ["image1.png", "image2.png"] }` — phase-groups with their images
+- **`ticket_report`** (string) — relative path to ticket report HTML, or empty if none exists
+- **`mtime`** (number) — Unix seconds of the most recent file touched in this feature's proof tree (0 if the feature has no proof yet)
+
+**Status codes:**
+- **200** — success
+- **404** `{ "error": { "code": "ENOLANE", "message": "lane not found" } }` — lane doesn't exist
+
+```http
+GET /api/lanes/:id/proof/:slug/:group/:file
+```
+
+Fetch a single proof file (PNG, JPG, or HTML). The file is resolved with path containment checks before serving:
+
+**Status codes:**
+- **200** — file content, `Content-Type` set to `image/png`, `image/jpeg`, or `text/html`
+- **404** — lane, slug, group, or file not found, or path escapes containment
+
+```http
+DELETE /api/lanes/:id/proof/:slug
+```
+
+Delete proof at one of three granularities: request body `{ "group": "phase-name", "images": ["file1.png"] }` deletes specific images from a phase, `{ "group": "phase-name" }` deletes an entire phase, or empty `{}` deletes all phases **except** `ticket/`.
+
+```json
+{ "deleted": 3 }
+```
+
+**Status codes:**
+- **200** — success, returns count of deleted files
+- **400** `{ "error": { "code": "EBADPATH", "message": "…" } }` — invalid slug, group, or image name; or attempt to delete `ticket/`
+- **404** `{ "error": { "code": "ENOLANE", "message": "lane not found" } }` — lane doesn't exist
+- **404** `{ "error": { "code": "ENOFEATURE", "message": "…" } }` — slug doesn't exist
+
+```http
+POST /api/lanes/:id/proof-link
+```
+
+Converge the clone-root `proof/` directory (if it exists at `<lane.cwd>/proof`) onto the canonical `.playwright-mcp/proof`. This is an explicit operation, never automatic — exposed only as `ccam lanes proof-link`. Idempotent.
+
+**Response:**
+
+```json
+{ "linked": true }
+```
+
+- **`linked`** (boolean) — `true` if the link was created or fixed, `false` if the symlink already pointed to the right place or a collision was avoided
+
+**Status codes:**
+- **200** — success
+- **404** `{ "error": { "code": "ENOLANE", "message": "lane not found" } }` — lane doesn't exist
+
+
 ### Locks
 
 Cross-lane named locks (`server/lib/named-lock.js`) — the OTHER axis from a