Build www: the site that explains Cheffry's Dungeon #2

www is now a two-page site about Cheffry's Dungeon, and every page has one Play button linking to https://game.cheffryjames.com.

• / covers what the game is (the hub, delves of up to four chefs, the daily board), what exists in v1 and nothing more, and a short note on how it's built.
• /how-to-play covers getting in, the delve controls, how a run goes, the three enemies, Skewer Spikes, the chests with their odds, and scoring and ghosts.

Where the facts come from. Every game fact on the pages is plain data in src/game.ts. Each value was taken from the game's repository at 5d461ee: content/.json for names and numbers, src/sim.ts for how a run works, and its pages and static/.js for the controls. I checked the game README's claims against its code rather than copying them; for example, a Baguette Knight is stunned twice as long when its charge ends in a wall. When the game changes, only src/game.ts needs to change.

Branding is a placeholder: the name, tagline and "CD" text wordmark are in src/brand.ts, and the colours are in design/tokens.json. Replacing those two rebrands the site. I added two tokens: a headline size (text-2xl) and a larger corner radius (radius-lg).

What moved and what went:

• src/page.ts became src/pages/layout.ts, home.ts and how-to-play.ts, as AGENTS.md says to do once there is a second page.
• The notes form routes (POST /notes, /notes/:id/delete) are gone. So are the back, readNotice, cookie and readForm helpers only they used, and static/live.js. The pages now run no JavaScript and the app sets no cookies.
• Pages are sent with cache-control: public, max-age=60; the old page had no caching header.
• app.css is rewritten for the site.
• README and AGENTS.md describe the new layout.

Contract unchanged. The notes API, MCP server, terminal, /events and audit are untouched. contract.json and contract/openapi.json are unchanged, and no permission was loosened. The security headers are the same on every response.

Tests. I replaced the test for the old notes page with three new ones:

• the home page explains the game and links to Play;
• /how-to-play states the controls, enemies, chests and score;
• neither page runs a script or links anywhere but this site and the game.

The form-post test was removed. The body-size-cap and cross-site-refusal tests now send to POST /api/notes instead of the removed form route; they check the same behaviour. bun test passes (44 tests), bun run lint:design is clean, and locally both pages answered in under 3 ms.

Chosen not to do: no sign-in on www (you sign in on the game itself), no images or third-party assets, no copy of the live leaderboard, and no biography.

To try it: open the preview's / and /how-to-play, click Play, and check a 360px-wide screen in both light and dark mode.

🤖 Generated with Claude Code

Closes #1