test(19.3-05): surf CORS, profiles, api-docs and store lookup; cabana reorder hook

- cors_profile_test.go: credentials with * refused (global and profile),
  pattern errors, anchored wildcard origins, Vary: Origin on dynamic
  answers, api/www credentialed case, unchanged * answers, profile
  preflight routes and boot errors, turnstile factory params
- apidocs_test.go: off by default, pinned 5.33.1 page with the RESEARCH
  SRI hashes and nonce CSP, ordered compact JSON, provider count, path
  validation, escaped title
- store_lookup_test.go: MemoryStore fallback, published Store, no dial
- reorder_hook_test.go (Postgres): hook sees the new order in the tx,
  its error rolls back, no hook answers unchanged
- gate: surf names in the go stage, cabana names in the docker stage

scripts/check-phase19.3.sh

@@ -65,7 +65,21 @@ BOUNCER_TESTS=(
 	TestTurnstileMiddlewareStatuses TestTurnstileNeverLogsSecret
 )
 
+SURF_TESTS=(
+	TestCORSCredentialsWildcardRefused TestCORSPatternErrors TestCORSWildcardOriginEntry
+	TestCORSVaryOnDynamicAnswers TestCORSSubdomainCredentialed TestCORSStarUnchanged
+	TestCORSOptionsMatchesLaravel
+	TestCORSProfilePreflightRoute TestCORSProfileUnknown TestCORSProfileWithPathsRefused
+	TestCORSProfileOverlapGlobal TestCORSProfileConflictingProfilesSamePath
+	TestTurnstileFactoryParams
+	TestAPIDocsOffByDefault TestAPIDocsServesPinnedPage TestAPIDocsSpecJSONOrder
+	TestAPIDocsJSONSpecInput TestAPIDocsProviderCount TestAPIDocsPathValidation
+	TestAPIDocsTitleEscaped
+	TestBuildRouterStoreFallback TestBuildRouterUsesPublishedStore TestBuildRouterNeverDials
+)
+
 # docker stage: testcontainers suites.
+DOCKER_CABANA_TESTS=(TestReorderHookRunsInTx TestReorderHookErrorRollsBack TestReorderWithoutHookUnchanged)
 
 usage() {
 	cat >&2 <<'EOF'
@@ -329,6 +343,7 @@ run_go() {
 	echo "vet -tags summercms_s3: $ROOT/modules/lagoon/..."
 	go_short "$ROOT"
 	go_named "$ROOT" ./modules/bouncer -short "${BOUNCER_TESTS[@]}"
+	go_named "$ROOT" ./modules/surf -short "${SURF_TESTS[@]}"
 	echo "phase19.3 go passed"
 }
 
@@ -341,7 +356,8 @@ run_docker() {
 		echo "refuse: the docker stage needs a reachable Docker daemon (testcontainers); run it on a Docker host" >&2
 		return 1
 	fi
-	not_wired docker
+	go_named "$ROOT" ./modules/cabana "-timeout 20m" "${DOCKER_CABANA_TESTS[@]}"
+	echo "phase19.3 docker passed"
 }
 
 run_plugins() {