feat: patterns/ directory + skill-impact tracker (WikiSkill-inspired)

- New patterns/ directory with 7 initial failure-mode patterns (PAT-001..007)
- skill-impact.md audit trail for skill modifications
- _template.md for future pattern creation
- index.md updated with Patterns section
- log.md entry for this change
- Inspired by arXiv:2608.27454 (WikiSkill)

patterns/finanzblick-sync-waf.md

@@ -0,0 +1,53 @@
+---
+pattern_id: PAT-005
+title: "Finanzblick sync requires modal sequence — POST /sync is WAF-blocked"
+category: integration
+severity: medium
+status: active
+first_observed: 2026-07
+last_updated: 2026-08-30
+related_systems: []
+related_solution_docs: []
+related_skills: [finanzblick-cashflow]
+---
+
+# Finanzblick sync requires modal sequence — POST /sync is WAF-blocked
+
+## Symptom
+
+Programmatic synchronization with Finanzblick (banking data aggregator) fails when
+calling the `POST /sync` API endpoint directly. The request is blocked by the WAF
+(Web Application Firewall), returning 403 or connection reset.
+
+Historical fetches (without sync) work fine with the `--no-sync` flag, avoiding 2FA.
+
+## Root Cause
+
+Finanzblick's WAF detects and blocks automated POST requests to the sync endpoint
+that don't originate from the legitimate browser session with proper CSRF tokens
+and session cookies.
+
+## Mitigation
+
+Sync must be performed via the **UI button + 2FA modal sequence**:
+1. Navigate to the Finanzblick web interface in a browser
+2. Click the sync button (UI-triggered, not API)
+3. Handle the 2FA modal sequence in order:
+   - PIN modal → click OK
+   - AUTH modal → click WEITER
+   - ERR modal → click OK
+4. Wait for sync completion
+
+For historical data fetches (no sync needed), use the `--no-sync` flag — this
+bypasses 2FA entirely.
+
+## Prevention
+
+- Never attempt direct `POST /sync` calls — always use the UI flow
+- The `finanzblick-cashflow` skill encodes this modal sequence
+- This skill is USER-OWNED and needs `hermes curator adopt` to manage
+
+## Evidence
+
+- Observed during Finanzblick cashflow analysis sessions (Jul 2026)
+- MEMORY.md entry: "FB sync=UI btn+2FA modals(PIN→OK,AUTH→WEITER,ERR→OK). POST /sync=WAF-blocked. --no-sync flag for hist.fetches(no 2FA). fb-cashflow skill=USER-OWNED,needs `hermes curator adopt`."