refactor(router): move framework browser-test fixtures and routes out of app (#2138, #2135) (#2205)

Issue #2138: Three `BrowserTest*.cfc` controllers, their view folders, and
a stray `UserNotificationsMailer.cfc` demo were living in the dogfood app's
`app/` directory but are framework-internal, not app-level code. Anyone
copying this repo as a starting template or inspecting it as reference would
see fixtures they did not write.

Issue #2135: The same leak showed up in `config/routes.cfm` as a `/_browser`
scope with six routes — internal test infrastructure sitting in the one file
a developer is supposed to own.

Fix both in one pass, since they share the same files and routes:

- Move the three fixture controllers and their view folders into
  `vendor/wheels/public/browser-fixtures/{controllers,views}/`, alongside a
  minimal `Controller.cfc` base that provides a `$renderBrowserFixtureView`
  helper. Fixtures now render via explicit `cfinclude` + `renderText` so
  they do not depend on the normal Wheels view-path resolver (Wheels'
  `viewPath` setting is a single string pinned to `/app/views`).
- Add `vendor/wheels/public/browser-fixtures/routes.cfm` holding the
  `/_browser/*` route scope with the same named routes as before
  (`browserTestHome`, `browserTestLogin`, `browserTestAuthenticate`,
  `browserTestDashboard`, `browserTestLogout`, `browserTestLoginAs`).
- Auto-mount from `vendor/wheels/Global.cfc::$lockedLoadRoutes`, mirroring
  how `/wheels/public/routes.cfm` (the framework GUI) is already mounted.
  Gated by (a) `environment ∈ {testing, development}` and (b) a new opt-in
  setting `loadBrowserTestFixtures` that defaults to `false`.
- Enable the setting in this dogfood app via `config/settings.cfm` so
  browser specs that hit the real HTTP server keep working.
- Delete the six `/_browser` routes from `config/routes.cfm`; the file
  now matches the clean lucli scaffold template.
- Delete the stray `app/mailers/UserNotificationsMailer.cfc` plus its view —
  demo-only files that are already duplicated under `examples/tweet/` and
  `examples/starter-app/`.

Core test suite: 3250 pass, 0 fail, 0 error on Lucee 7 + SQLite. Manual
verification confirms `/_browser/home`, `/_browser/login`, `/_browser/login-as`,
and the full login → dashboard → logout redirect flow all return 200 when
the setting is on, and 404 when it is off.

Upgrade-guide entry added: apps that defined their own `/_browser/*` routes
of their own in 4.0-snapshot need to opt in to the new setting or declare
their own routes — the framework's routes register before `config/routes.cfm`
so same-named app routes still win.

Closes #2138
Closes #2135

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: bpamiri

CHANGELOG.md

@@ -140,6 +140,8 @@ All historical references to "CFWheels" in this changelog have been preserved fo
 
 ### Fixed
 
+- Framework-internal browser-test fixture controllers, views, and the `/_browser/*` routes no longer leak into application-level files. Moved from `app/controllers/BrowserTest*.cfc`, `app/views/browsertest*/`, and `config/routes.cfm` into `vendor/wheels/public/browser-fixtures/`, auto-mounted by `$lockedLoadRoutes` when environment is `testing` or `development` and the new opt-in setting `loadBrowserTestFixtures=true` is set. Apps upgrading from a 4.0 snapshot that had custom `/_browser/*` routes must opt in explicitly or re-declare them in `config/routes.cfm`. (#2135, #2138)
+- Stray `app/mailers/UserNotificationsMailer.cfc` demo removed from the framework repo root (byte-identical copies remain in the example apps under `examples/tweet/` and `examples/starter-app/`). (#2138)
 - View lookup after `renderText()` / `renderWith()` no longer breaks subsequent partial rendering (#1991)
 - Scaffolded apps from `wheels new` now boot correctly (#2096)
 - `wheels stats` crash on Lucee 7 — private `sprintf()` helper called `Left(result, 0)` when the format string started with a placeholder. Lucee 7 throws where Lucee 6 returned empty silently. Added a ternary guard per the project's cross-engine compatibility pattern.