A settled table is public: the reveal reads without an account, and it is the one page a cache may keep #47

Intent. At settlement nothing is secret — every charge, every score and every verdict is public by RULES.md §9. That makes the reveal the best thing this app produces and the only page it can serve identically to everyone; today it would sit behind private, no-store like everything else, unreachable to anyone without a forge account and uncacheable for the person who shares it.

Done looks like

• [ ] tableState on a settled or impounded table returns the same value to a guest, a seated player, the host and an admin — a test asserts the serialisations are byte-identical. The one viewer-dependent field (your_seat) is absent from a finished table's answer: a settled table has no "you".
• [ ] GET /tables/:id and GET /api/tables/:id answer public, max-age=60 with Vary: accept-encoding only when the table has settled or impounded, and keep private, no-store with the identity Vary in every other state. The decision is the action's (the state it returns), not a door's.
• [ ] A test walks a table to one act short of the binding and asserts it is still private, then settles it and asserts the same URL flipped — and that an unsettled table never answers a public cache header for anyone, including the host.
• [ ] The settled page reads as the story it is, built from src/pages/table.ts parts and inventing no markup: the accord that bound, each signature with the truth it paid, every said claim with the reveal's verdict beside it, the ranking, and when it ended in src/when.ts's words.
• [ ] The page carries its own absolute address to copy, from publicOrigin — a link that works for someone who has never signed in — and one line saying the table is over and public.
• [ ] README.md says which pages are public and why, beside the paragraph that explains private, no-store.

Files. src/actions.ts, src/routes.ts, src/pages/table.ts, src/server.test.ts, README.md.

Risks. This is the one place a caching mistake serves one player's redacted view to another, so make the public path unreachable from any state but finished — ideally by building the finished answer in a function that takes no who at all. An impounded table is finished too; check it as well. Sixty seconds is deliberate: a settled table never changes again, but a short life keeps a deploy honest.

Waits on #10 and #40. Suggested: @vesper.