Serve the customer-facing menus

Landing page, Section pages and archived sets rendered per request from the
store, with the approved design: hand-written CSS, self-hosted Archivo, a
copper pour line in the Section rail, an admin-only Thumbnail and a text page
index. Media is keyed by Page id so URLs survive publishing, and a Draft's
media needs a session. Includes the scrypt admin auth and the login throttle
the media rule needs.

README.md

@@ -6,9 +6,10 @@ photographed Pages, replacing the `scp`-a-JPG workflow. One instance per Site;
 
 ## Status
 
-Built so far: Site config parsing, the Menu Set store and the image pipeline,
-with tests. Not yet built: the public renderer, the admin, the container and the
-Ansible role.
+Built: Site config, the Menu Set store, the image pipeline, and the
+customer-facing renderer (landing page, Section pages, archived sets, media
+route) with the approved design. Not yet built: the admin, the container and
+the Ansible role.
 
 ## Layout
 
@@ -18,6 +19,12 @@ src/storage/manifest.ts   Manifest type, validation, atomic JSON writes
 src/storage/sets.ts       The Menu Set store: create, add Pages, publish, restore, delete
 src/storage/validate.ts   Boot validation: fatal problems and warnings
 src/images/pipeline.ts    sharp variants: Original, Viewing image, Thumbnail
+src/auth.ts               scrypt password hash, signed session cookie, login throttle
+src/render/               HTML builder, document shell, the customer pages
+src/routes/public.ts      Landing, Section, archive and media routes
+src/server.ts             buildApp (what tests drive) and main (what the container runs)
+public/                   Hand-written CSS, ~2KB of progressive-enhancement JS, Archivo
+config/                   Per-Site config, one file per Site
 test/                     node:test suites
 docs/plan.md              The agreed plan
 docs/adr/                 Decisions worth remembering
@@ -31,6 +38,8 @@ Node 24 or newer runs the TypeScript sources directly.
 npm install
 npm test          # node:test
 npm run typecheck # tsc --noEmit
+npm run seed      # placeholder Pages in .dev/data, for design review
+npm run dev       # http://localhost:3000 against .dev
 ```
 
 ## Storage model