docs(skill): add explicit HTTP verb guidance for server actions in agent skill

[vivek7405]

Problem

In .agents/skills/webjs/ (and references/data-and-actions.md), basic rules exist noting that form-bound actions default to POST and that export const method = 'GET' actions cannot be bound to forms. However, detailed guidance on selecting, declaring, and using HTTP verbs (POST, GET, PUT, PATCH, DELETE) across RPC server actions and form submissions is under-emphasized and fragmented for end-user AI agents.

When AI agents build apps with WebJs, they frequently:

• Leave read-only RPC server actions as default POST (missing out on ETag caching, URL query param passing, and 304 revalidation).
• Attempt to bind method = 'GET' server actions to <form action=${fn}> or <button formaction=${fn}>, triggering 405 runtime errors and webjs check violations (form-action-not-a-get-action).
• Manually write method="get" on bound forms, which triggers WEBJS_FORM_SUBMITTED_AS_GET diagnostic warnings.
• Misunderstand how non-POST mutating verbs (PUT, PATCH, DELETE) behave with RPC client stubs and tag invalidation (invalidates).

Design / approach & Decision Guide

HTTP Verbs Decision Guide for Server Actions

1. Form-Bound Actions (<form action=${fn}> / <button formaction=${fn}>):

   • MUST use POST (default method, no method export or export const method = 'POST').
   • NEVER declare export const method = 'GET' for a form action; binding a GET action to a form triggers a 405 runtime error and webjs check violation (form-action-not-a-get-action).
   • NEVER add method="get" to a bound form. WebJs supplies method="post" and formenctype automatically.

2. Programmatic / RPC Read Actions (Queries):

   • SHOULD export export const method = 'GET'.
   • Arguments ride URL query parameters (with automatic POST fallback if payload exceeds 4KB).
   • Enables ETag generation, 304 Not Modified revalidation, CSRF exemption, and export const cache = ... HTTP Cache-Control headers.

3. Programmatic / RPC Write Actions (Mutations):

   • Use default POST, or explicitly export PUT, PATCH, or DELETE.
   • Carries CSRF protection, sends rich serialized bodies, and evicts cached query tags using export const invalidates = (args...) => ['tag'].

Implementation notes (for the implementing agent)

• Where to edit:
  • .agents/skills/webjs/SKILL.md (Server Actions section).
  • .agents/skills/webjs/references/data-and-actions.md (HTTP-verb section).
  • .agents/skills/webjs/references/muscle-memory-gotchas.md (gotchas table).
  • packages/cli/templates/.agents/skills/webjs/ (sync skill files in scaffold templates).
  • website/app/docs/data-and-actions (sync docs site).
• Invariants to respect:
  • Form actions (action=${fn}) strictly enforce POST.
  • export const method = 'GET' actions cannot be bound to forms (form-action-not-a-get-action check).
• Test & doc surfaces:
  • webjs check on examples/blog and website.
  • Invoke webjs-doc-sync skill to verify doc surface parity across all surfaces.

Acceptance criteria

• .agents/skills/webjs/references/data-and-actions.md contains the complete HTTP Verbs Decision Guide for server actions.
• SKILL.md explicitly instructs AI agents on when to use export const method = 'GET' vs default POST for server actions.
• Scaffold templates (packages/cli/templates/.agents/skills/webjs/) are updated with the expanded HTTP verb guidance.
• Documentation site (website/app/docs/data-and-actions) reflects the updated guidance.