test(post): share createPhotoEntry helper and fix cleanup leak

Hoist the duplicated per-spec createEntry photo-fixture into a single
createPhotoEntry() in helpers.js (used by delete-flow, edit-mode, and the
anon-view draft). Register the tag for cleanup BEFORE the awaited 15s
success-toast assertion, so a create that lands on disk but whose toast
assertion times out no longer leaks an untracked entry. Add AE3b covering the
disclosure deviation branch (a non-default toggle auto-expands More options).

Code review F2 (leak), F3 (duplication), F6 (coverage).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Mpdu3Dt1iVoozHwAMyjrbn

tests/ui/post/anon-view.spec.js

@@ -13,10 +13,8 @@
 // short-lived authenticated context to create the draft fixture and confirm the
 // owner-visible side.
 const { test, expect } = require('@playwright/test');
-const path = require('path');
-const { fillEditor, waitForPhotoUpload, cleanupEntry, findEntry, ACTIVE_TRIP_URL } = require('../helpers');
+const { createPhotoEntry, cleanupEntry, findEntry, ACTIVE_TRIP_URL } = require('../helpers');
 
-const TEST_PHOTO = path.join(__dirname, '../../fixtures/test-photo.jpg');
 const AUTH_STATE = 'tests/.auth/user.json';
 const BASE = process.env.GRAV_BASE_URL || 'http://localhost:8081';
 
@@ -47,23 +45,11 @@ test('AN2: a draft entry is shown to the owner but hidden from an anonymous visi
     // Create an UNPUBLISHED entry as the owner, in a separate authed context.
     const owner = await browser.newContext({ storageState: AUTH_STATE, baseURL: BASE });
     const op = await owner.newPage();
-    await op.goto('/post');
-    await op.fill('input[name="data[title]"]', `UI Test ${tag}`);
-    await fillEditor(op, `Draft body ${tag}. Safe to delete.`);
-    await op.locator('input.filepond--browser').setInputFiles(TEST_PHOTO);
-    await waitForPhotoUpload(op);
-    // Flip Published → No. The toggle renders as a visually-hidden radio pair
-    // behind "More options", so set the state directly and fire `change` (what a
-    // real click would do) rather than fighting the visibility gate.
-    await op.evaluate(() => {
-        const off = document.querySelector('input[name="data[published]"][value="0"]');
-        off.checked = true;
-        off.dispatchEvent(new Event('change', { bubbles: true }));
+    await createPhotoEntry(op, tag, {
+        created,
+        publish: false,
+        content: `Draft body ${tag}. Safe to delete.`,
     });
-    await op.locator('.btn-post').evaluate(el => el.click());
-    await expect(op.locator('.form-messages, .notices')).toContainText(
-        'Entry posted successfully!', { timeout: 15_000 });
-    created.push(tag);
     expect(findEntry(tag), 'draft fixture should exist on disk').not.toBeNull();
 
     // Owner side: the draft appears in the feed WITH a Draft badge.