Three fixes the round trips found:
The produce-box select reported the SUBSCRIPTION rather than the delivery. A
one-off switch changes the delivery while the standing order keeps naming the
old box, so during the exact week someone had changed it the entity showed the
wrong box. It now reads the order.
parse_vacation_holds looked for ISO dates. The page writes 'Tuesday, Dec 1 -
Monday, Dec 7', so it reported no holds on an account that had one — which is
indistinguishable from having none. Its test asserted the same wrong format,
so the test passed while the parser was blind.
Adds hold removal (POST /s/submit/pause-range-remove), whose popup only exists
while a hold does.
The boxes are not in the Algolia catalogue and their category pages look empty
because the grid calls every option 'Georgia Box' — each option's real name is
only in its own select-basket popup, so listing reads them there.
POST /s/submit/select-basket carries a scope the add-on endpoints do not:
popup-toggle is 'do' for the next delivery or 'so' for the standing order. The
select uses 'do', because a mistaken permanent change is the worse one to undo.
Also makes the popup regexes whitespace-tolerant. The site writes both
openPopup("x","y") and openPopup("x", "y"), and the strict form silently
matched nothing on the basket pages.