v5.0.0: protocol v5 and the browser frontend

Protocol v5 replaces newline lines with bounded [u32 len][text] frames and REQ/RES/EVT envelopes. Requests carry correlation ids and the server replays the last 256 replies per connection, so a gateway retry cannot double-debit and a late reply cannot clobber a newer request. HELLO/PONG carry server time; crash rounds announce started_at and push coalesced 10 Hz ticks. Crash now commits sha256(seed) before a round and reveals the seed when it ends, so clients recompute the crash point.

Adds the webd/ gateway: one blocking thread, one ClientCore and one pinned upstream TLS connection per session, an HttpOnly session cookie, takeover, and a 60-second grace window. The browser sends Command JSON and renders View JSON; it never speaks the game protocol or stores credentials.

Adds the vanilla TypeScript browser app at /play/ (login, lobby, all four games, history, notices, crash verification), the nginx /play and /ws routes, and the headless DOM smoke test. webd and the app stay out of the TUI/GUI/server build graph.

The client/server version moves to 5.0.0 in lockstep; v4 peers are refused at HELLO.

1 files changed, 12 insertions, 1 deletions

diff --git a/scripts/deploy.sh b/scripts/deploy.sh
index 63bd31c..0527505 100755
--- a/scripts/deploy.sh
+++ b/scripts/deploy.sh
@@ -67,6 +67,7 @@ if [ "$VERIFY_ONLY" -eq 0 ]; then
   RSYNC_FLAGS=(
     -a --delay-updates --human-readable --chmod=D755,F644
     --exclude=README.md --exclude=.gitignore
+    --exclude=play/node_modules
   )
 
   if [[ "$TARGET" == *:* ]]; then
@@ -160,6 +161,16 @@ for local in "${artifacts[@]}"; do
   verified=$((verified + 1))
 done
 
+curl -fsSL --max-time 30 "$origin/play/" -o "$tmp/play.html" \
+  || die "could not fetch the browser app at /play/"
+grep -q 'app.js' "$tmp/play.html" || die "/play/ does not reference app.js"
+for asset in app.js style.css; do
+  curl -fsSL --max-time 30 "$origin/play/$asset" -o "$tmp/$asset" \
+    || die "could not fetch /play/$asset"
+  cmp -s "web/play/$asset" "$tmp/$asset" \
+    || die "/play/$asset served from the site differs from the local file"
+done
+
 [ "$failed" -eq 0 ] || die "verification failed"
 
-echo "==> $verified artifact(s) verified at $URL"
+echo "==> $verified artifact(s) and the browser app verified at $URL"