Pin vendored TinyMCE at 6.8.6 (ADR 0013)

6.8.6 is the last MIT-licensed release; 7.0+ requires a commercial
license. Documents the constraint and syncs it across CLAUDE.md,
CODEX.md, and copilot-instructions.md per the instruction-sync rule.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/copilot-instructions.md

@@ -40,6 +40,7 @@
 
 ## Libraries
 - Do not upgrade Spire.PDF beyond version 8.10.5.
+- Do not upgrade the vendored TinyMCE (`Fuchs/wwwroot/lib/tinymce/`; legacy copy at `Fuchs/Scripts/tinymce/`) beyond version 6.8.6 — the last MIT-licensed release; 7.0+ is commercially licensed. See `Fuchs/Docs/Decisions/0013-tinymce-pinned-to-6-8-6.md`.
 - Make use of OCORE libraries where possible, especially for common tasks such as logging, configuration management, and data access.
 - Whenever possible, prefer OCORE_web_pdf / OCORE PDF functions for PDF-related tasks over rewriting.
 - Do not use OCMS or OCMS_sharp; use only OCORE or OCORE_web.

CLAUDE.md

@@ -34,6 +34,7 @@
 
 ## Libraries
 - Do **not** upgrade Spire.PDF beyond 8.10.5. Prefer OCORE / OCORE_web / OCORE_web_pdf helpers over rewriting. Do not use OCMS/OCMS_sharp — OCORE only.
+- Do **not** upgrade the vendored TinyMCE (`Fuchs/wwwroot/lib/tinymce/`; legacy copy at `Fuchs/Scripts/tinymce/`) beyond **6.8.6** — the last MIT-licensed release; 7.0+ is commercially licensed. See `Fuchs/Docs/Decisions/0013-tinymce-pinned-to-6-8-6.md`.
 
 ## Services & Dependency Injection
 - Business logic lives in **DI-registered services** under `Fuchs/Services/` behind interfaces, injected into `IntranetController`. Do not reintroduce static God-classes or pass the controller into helpers.

CODEX.md

@@ -34,6 +34,7 @@
 
 ## Libraries
 - Do **not** upgrade Spire.PDF beyond 8.10.5. Prefer OCORE / OCORE_web / OCORE_web_pdf helpers over rewriting. Do not use OCMS/OCMS_sharp — OCORE only.
+- Do **not** upgrade the vendored TinyMCE (`Fuchs/wwwroot/lib/tinymce/`; legacy copy at `Fuchs/Scripts/tinymce/`) beyond **6.8.6** — the last MIT-licensed release; 7.0+ is commercially licensed. See `Fuchs/Docs/Decisions/0013-tinymce-pinned-to-6-8-6.md`.
 
 ## Services & Dependency Injection
 - Business logic lives in **DI-registered services** under `Fuchs/Services/` behind interfaces, injected into `IntranetController`. Do not reintroduce static God-classes or pass the controller into helpers.

Fuchs/Docs/Decisions/0013-tinymce-pinned-to-6-8-6.md

@@ -0,0 +1,48 @@
+---
+status: Accepted
+date: 2026-09-09
+applyTo:
+  - "Fuchs/wwwroot/lib/tinymce/**"
+  - "Fuchs/Scripts/tinymce/**"
+supersededBy: ""
+---
+
+# 0013 — TinyMCE pinned to 6.8.6
+
+## Context
+TinyMCE releases from 7.0 onward are licensed under a proprietary/commercial
+license (with a source-available "open core" carve-out that no longer covers
+the full feature set previously used). TinyMCE 6.8.6 is the last release
+published under the plain MIT license. The active app vendors TinyMCE
+directly under `Fuchs/wwwroot/lib/tinymce/` (currently 6.8.6) rather than via
+a package manager that enforces license terms automatically. A second,
+older vendor drop lives at `Fuchs/Scripts/tinymce/` (currently 6.3.1) used
+only by the legacy `Intranet_Legacy` VB.NET app — it is not required to
+match the active app's version, only to stay under the same ceiling.
+
+## Decision
+TinyMCE must never be upgraded beyond **6.8.6**, in either vendored copy.
+Any change that touches `Fuchs/wwwroot/lib/tinymce/` must keep `version` in
+its `package.json` at `6.8.6` or lower. Do not pull in a newer TinyMCE
+release, plugin, or skin — including via `npm`/`bower`/`composer` metadata
+files bundled in the vendor folder — even to pick up a bug fix or new
+plugin.
+
+## Consequences
+- Security/bug fixes for TinyMCE past 6.8.6 will not be available; any such
+  issue must be worked around locally (patch the vendored copy) rather than
+  by upgrading.
+- New TinyMCE features/plugins released in 7.x+ are off-limits unless the
+  project separately decides to accept the commercial license (a decision
+  that would supersede this one).
+- The two vendored copies do not need to share the same version, but neither
+  may exceed 6.8.6.
+
+## Alternatives considered
+- **Upgrade to latest TinyMCE and accept the commercial license terms** —
+  rejected: no budget/approval for a commercial license, and the project has
+  no other proprietary runtime dependencies of this kind.
+- **Switch to a different MIT-licensed rich text editor** — rejected for now
+  as out of scope; would require rewriting the existing draft-editing
+  integration (see `Fuchs/Docs/Concepts/live-draft-editing.md`). Can be
+  revisited later.