chore(ai): triage TODOs and create issues

- Scan repository for TODO/FIXME comments.
- Generate `artifacts/todos.txt` with identified items.
- Create `issues/todo-issue-1.md` for flaky hashtag preferences test.
- Create `issues/todo-issue-2.md` for failing visual moderation tests.
- No trivial fixes found; all identified TODOs require investigation.

Co-authored-by: PR0M3TH3AN <[email protected]>

artifacts/todos.txt

@@ -1 +1,8 @@
 js/ui/profileModalController.js:204:      "Formats npub strings for display using the canonical short representation (npubXXXX…XXXX).",
+tests/hashtag-preferences.test.mjs:307:      // TODO: This part of the test is flaky in CI environments.
+tests/visual/moderation.spec.ts:89:    // TODO: Investigate why visibility check fails in fixture environment (headless)
+tests/visual/moderation.spec.ts:93:    // TODO: Investigate why click times out in fixture environment (headless)
+tests/visual/moderation.spec.ts:166:    // TODO: Investigate visibility check failure
+tests/visual/moderation.spec.ts:170:    // TODO: Investigate click timeout failure
+tests/visual/moderation.spec.ts:219:    // TODO: Investigate visibility check failure
+tests/visual/moderation.spec.ts:223:    // TODO: Investigate click timeout failure

issues/todo-issue-1.md

@@ -0,0 +1,27 @@
+# todo: Investigate flaky hashtag preferences test in CI
+
+**File:** `tests/hashtag-preferences.test.mjs` (Line 307)
+**Priority:** Medium
+**Tags:** ai, needs-review
+
+**Description:**
+The test "load defers permission-required decrypts until explicitly enabled" contains commented-out code marked with a TODO indicating flakiness in CI environments.
+
+**Context:**
+```javascript
+      // TODO: This part of the test is flaky in CI environments.
+      // Logs confirm the code attempts decryption ("Attempting decryption via window.nostr fallback"),
+      // but the mock spy is not consistently called, likely due to runNip07WithRetry/microtask timing.
+      //
+      // await hashtagPreferences.load(pubkey, { allowPermissionPrompt: true });
+      //
+      // assert.equal(
+      //   decryptCalls.length,
+      //   1,
+      //   "explicit permission prompts should retry decryption",
+      // );
+      // assert.deepEqual(hashtagPreferences.getInterests(), ["late"]);
+```
+
+**Suggested Next Step:**
+Investigate the timing issues with `runNip07WithRetry` and the microtask queue to reliably mock the permission prompt behavior in tests.

issues/todo-issue-2.md

@@ -0,0 +1,24 @@
+# todo: Investigate failing visual moderation tests in headless mode
+
+**File:** `tests/visual/moderation.spec.ts`
+**Priority:** Medium
+**Tags:** ai, needs-review
+
+**Description:**
+Multiple tests in `tests/visual/moderation.spec.ts` have commented-out assertions due to failures in headless/CI environments. These failures relate to visibility checks and click timeouts.
+
+**Context:**
+```typescript
+    // TODO: Investigate why visibility check fails in fixture environment (headless)
+    // await expect(showAnywayButton).toBeVisible();
+
+    // TODO: Investigate why click times out in fixture environment (headless)
+    // await showAnywayButton.click({ force: true });
+```
+This pattern repeats in:
+- "show anyway override persists across reloads"
+- "trusted report hide fixture supports show anyway override"
+- "trusted mute hide fixture annotates mute reason and can be overridden"
+
+**Suggested Next Step:**
+Investigate why the headless environment (fixture) causes these visibility checks and clicks to fail. It might be related to rendering speed, element overlap, or how the fixture loads.