docs(site): the Asset Bridge — protocol 8, a screen for client files, and pictures in the screenshots (Phase 9c)

The last leg of the Asset Bridge (docs/link/v8.md §16, phase 9c). The cutover put
protocol 8 on `main` in every declaration site, which turned this repo red by
construction: `checkFacts.mjs` reads the protocol from `link`'s `main`.

Two checks were failing, and only one of them was expected.

**checkFacts (10)** — protocol 7 → 8 in all three reads (sidecar, overlay, bundle),
the bundle triple to 2026.09.15 / sidecar v2.3.0 / overlay v1.3.0, and the releases
to link v2.3.0, installer v0.2.0, Module-uo v1.3.0. `moduleApi` and the capability
list did not move: core's whole share of eight phases was a deletion.

**checkReference (9)** — nobody had planned for this one. `Bridge.cfg` grew nine keys
across phases 5, 6 and 7 and the reference page had gone on not mentioning them,
which is the failure mode that check exists for. They are listed as two new groups,
`Client assets` and `Spawn files`, because they are two separate consents.

## The prose the bridge changed

- **New page, Administration → Client files.** `Admin → Client files` is a screen an
  operator has to press a button on and the site had no page for it. It carries the
  rule nothing else states: **nothing here happens on a restart**, so a patched client
  keeps serving the old artwork until somebody says so.
- **Protocol versions** said the most recent bump touched five repositories and named
  `website`. Protocol 8 touched four and did not reach core — its absence is the
  interesting half, and the page now says why. The store-migration paragraph gains 8,
  which changed no line of the sidecar's store despite moving megabytes.
- **The bridge** said "two ways in". There are three: bulk reads go over the
  request/reply path in pages, one in flight at a time, and the reason they must not
  ride the event stream is structural rather than about speed.
- **Requirements** gains `libgdiplus` for Linux shard hosts, and the note that no game
  client has to be installed for any of this — a ServUO shard cannot boot without one.
- **Troubleshooting** gains the failure mode that did not exist before: a bestiary with
  no pictures, or items reading as numbers.
- **Maintenance** gains the button to press after patching a client, and **Verify the
  whole stack** the `doctor` check that landed with it.
- The spawn atlas and the marketplace both carry artwork now, so both capability
  descriptions say so, and `canonicalDocs` points at `link/v8.md`.

## Screenshots, retaken against the real thing

The atlas and marketplace shots predate the asset plane, so both were retaken on the
demo deployment against a real shard and a real sidecar, plus the new admin screen:
1,095 portraits imported in 2.1 s, 67,496 names in 1.4 s, 313 item pictures in 0.8 s.
Nothing here is a mock-up. The atlas shot moved 36px down its page because portraits
made the rows taller.

## One defect found on the way

`seedDemo.mjs` pinned the demo deployment at **protocol 4** with a comment explaining
a `module-uo` debt that has since been paid. Its default now comes from
`platform.json`, so the rig cannot drift two protocols behind the platform again.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016wDDVXWMDz82WqE1i969r4

src/data/reference.mjs

@@ -201,6 +201,33 @@ export const bridgeCfg = {
     AccountNameMaxLength: 'Account name cap',
     AccountPasswordMaxLength: 'Account password cap',
   },
+  'Client assets': {
+    AssetsEnabled:
+      'Whether the website may read the UO client files on this host \u2014 art, animations, ' +
+      'the string table \u2014 over the link at all. Its own switch, because it is its own consent',
+    AssetBatchBytes:
+      'Byte budget for one reply page, inside the 1 MiB line cap the sidecar accepts',
+    AssetBodyBatch:
+      'Bodies one catalogue request may name. Counted in items rather than bytes, because ' +
+      'what it bounds is building and deleting that many real mobiles on the core thread. ' +
+      'A larger request is refused, never truncated',
+    AssetFetchKeys:
+      'How many keys one fetch may name. The byte budget above still decides where a page is cut',
+    AssetScanMs: 'How long a catalogue scan may run before the page it has is returned',
+    AssetPlayerDirection:
+      'Which of the five directions a player body renders as. 0 is head-on, facing the viewer',
+    AssetCreatureDirection:
+      'The same for everything else. 1 is the front three-quarter \u2014 a wolf seen head-on ' +
+      'is a dark blob',
+  },
+  'Spawn files': {
+    TreeEnabled:
+      'Whether the shard configuration itself \u2014 spawn files, regions, locations, champion ' +
+      'spawns, decoration \u2014 may cross the bridge. A third switch for a third consent: ' +
+      'this is the work of the operator rather than the game client. Off means the spawn ' +
+      'atlas needs a shared filesystem again',
+    TreeChunkBytes: 'How large a slice of one file may be before it is compressed and sent',
+  },
 };
 
 /**
@@ -224,7 +251,8 @@ export const canonicalDocs = {
   'website/TRUSTED_DEVICES_MFA.md': 'Trusted devices and the second factor',
   'link/PLAN.md': 'The sidecar design of record, the data catalog and the wire protocol',
   'link/INTEGRATION.md': 'Integrating with the sidecar',
-  'link/v7.md': 'The current protocol, and its cross-repository obligations',
+  'link/v8.md': 'The current protocol, and its cross-repository obligations',
+  'link/SHARD_PREREQS.md': 'What a shard host needs before any of this works',
   'link/ADMIN_CONTROLS.md': 'What the site may command the game to do',
   'installer/INSTALL.md': 'The operator guide for setting a shard up',
   'installer/PLAN.md': "The installer's design of record",