plan: intake to plan by a model; doors, labelled groups, the whole card

Work from another session, committed as found (tests green):

- `plan` reads an intake into a plan.yaml (a model decides needs,
  stages, forms and budgets; a person reads the result before build).
- Plans gain `doors` (a first question before the forms, when a front
  door would carry more than five needs), `groups` with labels that a
  select may draw its options from (`options_from: groups`), `private`
  fields kept off public pages, `multiple` selects, and `max_fields`
  as what the intake said the person will tolerate.
- `card.rs`: an alternative as the visitor meets it, in text, so the
  answering visitor and `rate` read the served card, not the heading.
- `rate` reads followup pages from the repo and reports "what happens
  next" as not measured rather than zero when it cannot.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L4jrCgLiKKHAEFuZUJjckH

engines/claude.sh

@@ -0,0 +1,22 @@
+#!/bin/sh
+# LLM backend for portal-trainer on Claude Code's own login (a Max or
+# Pro subscription): prompt on stdin, text on stdout. No API key
+# needed: an ANTHROPIC_API_KEY in the environment would outrank the
+# login, so it is dropped here. Log the CLI in once with
+# `claude auth login`; `claude auth status` shows what it uses.
+# MODEL is an alias or id (sonnet, opus, claude-sonnet-5); EFFORT is
+# low, medium or high. Not --bare: that mode skips the stored login.
+#
+# The generator's SEED and TEMPERATURE hints cannot be honoured;
+# FORMAT=json is turned into an instruction.
+set -eu
+unset ANTHROPIC_API_KEY ANTHROPIC_AUTH_TOKEN CLAUDECODE CLAUDE_CODE_ENTRYPOINT
+prompt=$(cat)
+if [ "${FORMAT:-}" = json ]; then
+  prompt="$prompt
+
+Reply with the JSON object only, no prose, no code fences."
+fi
+printf '%s' "$prompt" | claude -p --model "${MODEL:-sonnet}" --effort "${EFFORT:-low}" \
+  --output-format text --permission-mode dontAsk --no-session-persistence \
+  --tools ""