feat(polish): phase 10 — search, accessibility, SEO and a real CSP

PLAN.md §13 phase 10, with four decisions of record — D47-D50, taking the count
to fifty. Three were straightforward; the CSP turned into the phase's real work,
because the thing meant to be a configuration flag was broken in a dependency and
broken silently.

D47 — search reaches the marketing pages, and the header gets a box.
Base.astro marks its <main> as a Pagefind body, so all ten join the index the
docs already query, and Search.astro opens it in a <dialog>. Nothing is fetched
until the dialog is opened (the bundle is 120 kB and these pages otherwise ship
almost no JavaScript). Pagefind titles a result from the first <h1>, and these
pages have editorial ones — "The app for a deployment you already use" — so the
index is given the page's short name instead. applyBrand.mjs now re-indexes after
a rewrite, closing a note phase 2 left for this phase.

D48 — the CSP is a real response header, sent by the container. Not a <meta>,
which ignores frame-ancestors, and not advice for someone's reverse proxy, which
puts the strictest promise in §6 outside what this repo tests. Three things
fought it, all the same shape — correct build, broken page, no error:

  * Astro does not hash <script is:inline>, and Starlight ships six per docs
    page, so the first build with CSP on had a strict header and a dead theme
    switcher. The hashes are now generated into src/config/cspHashes.mjs and
    checkCsp.mjs verifies every inline block against its own page's policy.
  * Expressive Code writes ~3,700 inline style ATTRIBUTES, which cannot be
    hashed, hence style-src-attr 'unsafe-inline' — scoped to that directive, so
    script-src is untouched.
  * @astrojs/node matched a request to a policy with pathname.includes(), a
    substring test: /modules/ was served /docs/modules/building-a-module's
    policy and rendered with its own stylesheet refused. scripts/serve.mjs keeps
    the same _headers.json and matches by equality; test/headers.test.mjs starts
    the server and reads the responses, because nothing that reads dist/ can see
    this.

D49 — robots.txt allows everything and names the sitemap (there was no way to
find it: no robots.txt, and D9 rules out a search console). D50 — Organization
and SoftwareApplication, no ratings and no docs-wide Article markup.

checkA11y.mjs is the eleventh check: seven structural rules over all fifty pages,
verified by breaking each in turn. The walk at 390/768/1280 found no overflow
anywhere, the CSP violations above, a 17x17 consent checkbox (WCAG 2.2 SC 2.5.8
wants 24), and a skip link that moved the scroll but not the focus.

npm run verify is green: fourteen steps, both test suites, all eleven checks.

Co-Authored-By: Claude <noreply@anthropic.com>

scripts/applyBrand.mjs

@@ -229,10 +229,71 @@ const counts = new Map(replacements.map((r) => [r.field, 0]));
 counts.set('demoDeep', 0);
 let filesTouched = 0;
 
+/**
+ * The CSP (§6, D48) hashes every inline `<script>` and `<style>` in the build. This script
+ * runs after that hashing and rewrites the same files, so a brand value that happened to
+ * sit inside an inline block would change its bytes, invalidate its hash and get the block
+ * refused by the browser — with no error anywhere except a console nobody has open. The
+ * page would render perfectly and the script simply would not run.
+ *
+ * Nothing puts brand text in an inline script today, and the replacements are guarded by
+ * MIN_REWRITABLE_LENGTH so they are unlikely to collide by accident. "Unlikely" is not the
+ * standard for a failure this quiet, so the collision is checked rather than reasoned
+ * about: if a rewrite ever lands inside an inline block, this refuses to write that file
+ * and says so, and the page keeps its stock text instead of losing its behaviour.
+ */
+const INLINE_BLOCK = /<(script|style)(?![^>]*\bsrc\s*=)([^>]*)>([\s\S]*?)<\/\1>/g;
+
+/**
+ * The structured-data block (D50) is a `<script>` that no browser executes and no CSP hash
+ * covers, so it is not one of the blocks this guard protects — and it MUST NOT be, because
+ * it contains the site's name. Treating it as a script would make the guard refuse to
+ * rewrite the homepage, which is §7 failing on the one page that matters most.
+ */
+const DATA_BLOCK = /type\s*=\s*["']application\/(ld\+json|json)["']/i;
+
+const inlineRanges = (html) => {
+  const ranges = [];
+  INLINE_BLOCK.lastIndex = 0;
+  let match;
+  while ((match = INLINE_BLOCK.exec(html))) {
+    if (match[1] === 'script' && DATA_BLOCK.test(match[2])) continue;
+    // Where the block's CONTENT starts — measured back from the end of the whole match, so
+    // the opening tag's attributes cannot throw the offset off: `</script>` is the tag name
+    // plus three characters.
+    const closing = match[1].length + 3;
+    const start = match.index + match[0].length - closing - match[3].length;
+    ranges.push([start, start + match[3].length]);
+  }
+  return ranges;
+};
+const hitsInlineBlock = (html, needle) => {
+  if (!needle || !html.includes(needle)) return false;
+  const ranges = inlineRanges(html);
+  if (ranges.length === 0) return false;
+  for (let at = html.indexOf(needle); at !== -1; at = html.indexOf(needle, at + 1)) {
+    const end = at + needle.length;
+    if (ranges.some(([from, to]) => at < to && end > from)) return true;
+  }
+  return false;
+};
+const inlineCollisions = [];
+
 for (const file of walk(CLIENT)) {
   const before = readFileSync(file, 'utf8');
   let after = before;
 
+  if (path.extname(file) === '.html') {
+    const colliding = replacements.filter(({ from }) => hitsInlineBlock(before, from));
+    if (colliding.length) {
+      inlineCollisions.push({
+        file: path.relative(CLIENT, file),
+        fields: [...new Set(colliding.map((c) => c.field))],
+      });
+      continue;
+    }
+  }
+
   for (const { field, from, to } of replacements) {
     if (!after.includes(from)) continue;
     counts.set(field, counts.get(field) + after.split(from).length - 1);
@@ -270,6 +331,47 @@ if (counts.get('demoDeep')) {
   );
 }
 
-// Pagefind builds its search index from the HTML at BUILD time (phase 10), so a rename
-// applied here reaches the pages but not the search results. Worth fixing when search
-// lands; recorded here rather than in a plan section nobody will re-read.
+if (inlineCollisions.length) {
+  console.error(
+    `\n[brand] ${inlineCollisions.length} file(s) were LEFT UNCHANGED: a brand value occurs ` +
+      `inside an inline <script> or <style>, and rewriting it would break that block's CSP ` +
+      `hash (§6, D48) — the page would render and the script would silently not run.\n`
+  );
+  for (const { file, fields } of inlineCollisions) {
+    console.error(`  ! ${file}  (${fields.join(', ')})`);
+  }
+  console.error(
+    `\n  Those pages keep the stock text. Fix it by taking the brand value out of the inline\n` +
+      `  block — move it into markup the CSP does not hash, or into /brand/theme.css.\n`
+  );
+}
+
+/* ---------------------------------------------------------------------------------------
+   Search
+   --------------------------------------------------------------------------------------- */
+
+/**
+ * Pagefind builds its index from the built HTML at BUILD time, so everything above reaches
+ * the pages and none of it reaches the search results: a site renamed through the mount
+ * would answer a search for its own name with the stock one, and every result title would
+ * still carry the old suffix. Phase 2 recorded that and left it for this phase, when
+ * search became site-wide (D47).
+ *
+ * The fix is to re-index, which is cheap and needs nothing the container does not already
+ * have — Pagefind is what Starlight ran at build. It only runs when a rewrite actually
+ * happened, so the stock deployment, which is the common case, still pays nothing.
+ */
+if (filesTouched > 0) {
+  const pagefind = await import('pagefind');
+  try {
+    const { index } = await pagefind.createIndex();
+    const { page_count } = await index.addDirectory({ path: CLIENT });
+    await index.writeFiles({ outputPath: path.join(CLIENT, 'pagefind') });
+    console.log(`[brand] re-indexed ${page_count} page(s) for search so results agree with it.`);
+  } catch (error) {
+    // Search degrading to stale titles is not a reason to refuse to serve the site.
+    console.error(`[brand] could not rebuild the search index; it keeps the built one: ${error.message}`);
+  } finally {
+    await pagefind.close();
+  }
+}