buds Phase 2: top-3 username|email autocomplete on #id_recipient (post share + my_buds add); implicit symmetric auto-add on share_post (sharer ↔ recipient buds graph); recipient field accepts username OR email — TDD

- billboard.views.search_buds(GET /billboard/buds/search?q=...) — top-3 prefix match against request.user.buds via Q(username__istartswith) | Q(email__istartswith). Returns {buds: [{id, username, email}]}. Privacy: only the user's own buds are searched, no leak of strangers.
  - _resolve_recipient(raw) helper resolves a free-form recipient (email if "@" present, else username, both case-insensitive). Wired into add_bud + share_post so #id_recipient accepts either form.
  - share_post implicit auto-add (per-spec): when recipient is registered + first-time-shared, both directions of buds M2M get the link — request.user.buds.add(recipient) AND recipient.buds.add(request.user). Idempotent, no auto-add on reshare/self/unregistered.
  - new bud-autocomplete.js shared module (apps/billboard/static/apps/billboard/) — bindBudAutocomplete(input, suggestionsEl, {searchUrl}). Mirrors sky.html birth-place picker: 250ms debounced fetch from MIN_CHARS=1, click-to-fill, Escape closes, click-outside closes, late-response drop. e.stopPropagation on suggestion-click so the bud-panel's outside-click handler doesn't fire and clear the input.
  - SCSS .bud-suggestions / .bud-suggestion-item mirrors .sky-suggestions but position:fixed bottom:4rem (aligned above the bud panel, with overflow:hidden on the panel forcing the dropdown to live as a sibling rather than a child). Landscape breakpoints clear the navbar/footer 4rem sidebars, 8rem at min-width 1800px.
  - both _bud_panel.html (post share) + _bud_add_panel.html (my_buds add) get the suggestions div sibling + script tags. Each panel's existing document click-outside handler now skips the suggestions container so a click inside doesn't close+clear. type="email" → type="text" since usernames are accepted; placeholder "friend@example.com or username".
  - new test classes in test_buds.py: SearchBudsViewTest (6 — prefix match, cap-3, email prefix, non-bud leakproof, empty-q, anon redirect) + SharePostImplicitAutoAddTest (4 — sharer.buds += recipient, recipient.buds += sharer, username-typed share, unregistered no-add) + AddBudViewTest.test_add_resolves_username_too. test_my_buds.py FT adds test_autocomplete_suggests_buds_by_username_prefix. test_sharing.py placeholder assertion updated to "friend@example.com or username".
  - 852 ITs (+11) + 5 my_buds FTs green.

Code architected by Disco DeDisco <discodedisco@outlook.com>
Git commit message Co-Authored-By:
Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/apps/billboard/views.py

@@ -311,12 +311,12 @@ def share_post(request, post_id):
     our_post = Post.objects.get(id=post_id)
     is_ajax = "application/json" in request.headers.get("Accept", "")
 
-    recipient_email = request.POST.get("recipient", "")
-    recipient = None
-    try:
-        recipient = User.objects.get(email=recipient_email)
-    except User.DoesNotExist:
-        pass
+    # Recipient may be email OR username — _resolve_recipient handles both
+    # (email if "@" present, else username lookup). The raw value is kept
+    # for the Line text since users see what they typed in the per-line
+    # rendering (post-refresh + optimistic JS append).
+    recipient_email = (request.POST.get("recipient") or "").strip()
+    recipient = _resolve_recipient(recipient_email)
 
     # Sharer-tries-to-share-with-themselves: silent no-op (existing behavior).
     if recipient is not None and recipient == request.user:
@@ -332,6 +332,12 @@ def share_post(request, post_id):
 
     if recipient is not None and not is_reshare:
         our_post.shared_with.add(recipient)
+        # Implicit auto-add to the buds graph — symmetric on shared events
+        # (per-spec): a share-event implies a mutual social link.
+        # `add()` is idempotent on M2M, no need to pre-check membership.
+        if request.user.is_authenticated:
+            request.user.buds.add(recipient)
+            recipient.buds.add(request.user)
 
     line = None
     brief = None
@@ -390,20 +396,34 @@ def my_buds(request):
     })
 
 
+def _resolve_recipient(raw):
+    """Resolve a free-form recipient (email OR username) to a User, or None.
+    Email match takes precedence — if the input contains '@' we don't even
+    try the username lookup, so a username that happens to match an email
+    user's local part doesn't get coerced. Used by add_bud + share_post."""
+    raw = (raw or "").strip()
+    if not raw:
+        return None
+    if "@" in raw:
+        try:
+            return User.objects.get(email__iexact=raw)
+        except User.DoesNotExist:
+            return None
+    try:
+        return User.objects.get(username__iexact=raw)
+    except User.DoesNotExist:
+        return None
+
+
 @login_required(login_url="/")
 def add_bud(request):
     if request.method != "POST":
         from django.http import HttpResponseNotAllowed
         return HttpResponseNotAllowed(["POST"])
 
-    email = (request.POST.get("recipient") or "").strip()
+    candidate = _resolve_recipient(request.POST.get("recipient"))
 
     bud = None
-    try:
-        candidate = User.objects.get(email=email)
-    except User.DoesNotExist:
-        candidate = None
-
     if candidate is not None and candidate != request.user:
         if candidate not in request.user.buds.all():
             request.user.buds.add(candidate)
@@ -416,6 +436,32 @@ def add_bud(request):
     return JsonResponse({"bud": bud})
 
 
+@login_required(login_url="/")
+def search_buds(request):
+    """Top-3 prefix-match autocomplete pool for #id_recipient inputs.
+    Pulls only from request.user.buds — buds that haven't been added yet
+    don't appear in the autocomplete (privacy-by-default; new buds enter
+    the list via explicit add or implicit auto-add on share/invite).
+    Matches case-insensitive on either username or email prefix."""
+    from django.db.models import Q
+    q = (request.GET.get("q") or "").strip()
+    if not q:
+        return JsonResponse({"buds": []})
+    matches = (
+        request.user.buds
+        .filter(Q(username__istartswith=q) | Q(email__istartswith=q))
+        .order_by("username", "email")[:3]
+    )
+    return JsonResponse({"buds": [
+        {
+            "id":       str(b.id),
+            "username": b.username or b.email,
+            "email":    b.email,
+        }
+        for b in matches
+    ]})
+
+
 @login_required(login_url="/")
 def save_scroll_position(request, room_id):
     if request.method != "POST":