v5.0.0: protocol v5 and the browser frontend

Protocol v5 replaces newline lines with bounded [u32 len][text] frames and REQ/RES/EVT envelopes. Requests carry correlation ids and the server replays the last 256 replies per connection, so a gateway retry cannot double-debit and a late reply cannot clobber a newer request. HELLO/PONG carry server time; crash rounds announce started_at and push coalesced 10 Hz ticks. Crash now commits sha256(seed) before a round and reveals the seed when it ends, so clients recompute the crash point.

Adds the webd/ gateway: one blocking thread, one ClientCore and one pinned upstream TLS connection per session, an HttpOnly session cookie, takeover, and a 60-second grace window. The browser sends Command JSON and renders View JSON; it never speaks the game protocol or stores credentials.

Adds the vanilla TypeScript browser app at /play/ (login, lobby, all four games, history, notices, crash verification), the nginx /play and /ws routes, and the headless DOM smoke test. webd and the app stay out of the TUI/GUI/server build graph.

The client/server version moves to 5.0.0 in lockstep; v4 peers are refused at HELLO.

1 files changed, 25 insertions, 0 deletions

diff --git a/web/nginx.conf.example b/web/nginx.conf.example
index 9fc942f..d440ab5 100644
--- a/web/nginx.conf.example
+++ b/web/nginx.conf.example
@@ -37,6 +37,31 @@ server {
         add_header Cache-Control "public, max-age=31536000, immutable";
     }
 
+    # The browser app: static files, no framework runtime.
+    location = /play {
+        return 301 /play/;
+    }
+
+    location /play/ {
+        try_files $uri $uri/ /play/index.html;
+        add_header Cache-Control "no-cache";
+        add_header X-Frame-Options "DENY" always;
+        add_header X-Content-Type-Options "nosniff" always;
+    }
+
+    # WebSocket gateway. Keep the upgrade headers and a long read timeout:
+    # a crash round can idle for a while between pushes.
+    location = /ws {
+        proxy_pass http://127.0.0.1:8890;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_read_timeout 3600s;
+        proxy_send_timeout 3600s;
+    }
+
     # The page rescans bin/ on every request, so don't cache it.
     location = /index.php {
         include fastcgi_params;