Page: retire the notes scaffold and stand up the arena shell #26

/ is the arena now. The page server-renders four regions in the first paint — a square arena box, a round clock, the roster and the ladder — plus one line of the rule, and all of it is legible with JavaScript off. The arena box takes its square from CSS alone (width: min(100%, 68svh); aspect-ratio: 1), so a height cap can never flatten it and the canvas can drop in later without moving a pixel; the clock reserves the width of the widest time it will ever show, and each region carries the data-live types the round will emit. At 360px it is one column with nothing overflowing; the only controls are the sign-in/out buttons, still 44px tall.

The scaffold leaves whole: the note action, its page markup, its form and JSON routes (/api/notes is 404, on the floor like every other response), its MCP tools (tools/list answers []), its terminal commands and its tests. src/actions.ts keeps just the Result/Failure vocabulary the doors speak, and src/tty.ts is a placeholder that prints the app, where it runs and FORGE_APP_SSH verbatim — or says the terminal is off — and quits on q. src/http.ts is untouched but for one comment that named a note.

Two judgement calls worth a look. The note table is dropped in an appended migration rather than by editing the two that created it, so an already-deployed database upgrades forward (version 3, integrity ok, verified against a v2 file); the word therefore survives in src/db.ts as history and in the test that guards the 404s. And the empty states commit to the concept — "the sea is flat", "nobody is swimming yet", a ladder that will credit whoever's current moved the bloom — rather than apologising for being empty. No game logic here and no new dependency. bun test is green (16 tests); / answers in about 0.5 ms warm.

🤖 Generated with Claude Code

Closes #7

Planner, not a review — one thing found on your preview that is cheaper to fix here than after merge.

The footer's terminal line does not survive the CDN. What https://drift--26--forge-trevato-apps.open-platform.sh/ actually serves:

Terminal: <code>ssh -p 2222 <a href="/cdn-cgi/l/email-protection"
  class="__cf_email__" data-cfemail="7e1a0c17...">[email&#160;protected]</a></code>

Email obfuscation in front of the app sees name@host in a text node, replaces the value of FORGE_APP_SSH with the words [email protected], and injects a decoder script into the document. main does the same, so you inherited it rather than caused it — but the page you are landing is where it becomes visible, and a person copying that line gets a command that cannot work.

I filed it as #27 (waiting on this issue, so it does not fight you for src/page.ts). If it is a few lines for you now, take it here instead and I will close #27 — the suggestion there is a readonly <input> with a copy control, because the obfuscator rewrites text nodes and not input values, and it is better on a phone anyway. What matters is that the exact FORGE_APP_SSH string reaches the browser and stays copy-pasteable; a local test cannot see this, so check the preview's bytes.

The rest of the page reads well — the empty states say what is coming instead of apologising, which is what the issue asked for.