docs/ARCHITECTURE.md records why internal/web.render replaces the chassis
JSON-API policy with a per-response nonce policy, and the failure each of the
three decisions prevents: a header-only policy because two policies on one
response intersect, a nonce instead of 'unsafe-inline' because the guarantee is
that only the reviewed same-document script reaches the fragment key, and a
fresh url-alphabet value because a reused nonce is worth 'unsafe-inline' to
anyone who waits for the next load and + or / would make enforcement depend on
entity decoding.
README.md now names the buttons the page actually renders and says outright
that there is no lifetime picker — the server's 24h default applies and
ttl_seconds is where a caller chooses.
base.html drops the opacity transition; nothing animates opacity.
.dockerignore is an allowlist, because the build stage COPYs only go.mod,
go.sum, vendor/, cmd/ and internal/. A blocklist forgets the file nobody
predicted, and for this service that file is a secret. .gitignore grows the
same protection for the working tree.
