LSU's own coaching surface, and what auditing the site turned up

Review threads live on the whole diff, not on one commit, so none are shown here - a thread's line means something in the branch's final form, and painting it into an intermediate step would put it on code it is not about.

README.mdmodified+24-0

Changes to README.md

		⋯42 linesShow the 42 lines above this hunk@@ -43,6 +43,30 @@ HQ's **Brand experience** editor controls colors, fonts, corners, density, modul
43	43
44	44	HQ's repository documents provisioning, API endpoints, native app builds and launch decisions in `docs/developers/branded-coaching.md`. The new HQ database migrations and application deployment must be released before enabling the live LSU embed. This repository change does not deploy either site.
45	45
	46	+## Built, with nothing on the site reaching it
	47	+
	48	+Two working features have no entry point in the current pages. Both were
	49	+added and then lost when the site was rebuilt from the production capture, so
	50	+they are listed here rather than left to be found again by accident.
	51	+
	52	+**The live scoreboard.** `resources/data/live.ts` mirrors the race's own board
	53	+- which publishes no JSON, so it lifts the state out of the page the worker
	54	+serves - and `routes/api.ts` serves it at `GET /api/live`, cached for a minute
	55	+and answering 503 with `ok: false` rather than a page of zeroes when upstream
	56	+is down. Nothing fetches it. The only consumer left is the 404 page, which
	57	+asks it whether the race is running to decide what to link to. Restoring the
	58	+standings means rendering `livePayload` on `/results` and polling that
	59	+endpoint; the shape is the same server-side and in the browser so the table
	60	+cannot drift between them.
	61	+
	62	+**The newsletter.** `app/Actions/SubscriberEmailAction.ts`,
	63	+`ConfirmSubscriptionAction.ts`, both `app/Mail/Subscription*` classes and the
	64	+three templates in `resources/emails/` implement a real double opt-in, and
	65	+`/api/email/confirm` is the middle step the framework does not provide. No
	66	+page has a signup form, so nobody can start the flow. Adding one also needs
	67	+privacy copy: the current `/privacy` documents analytics, server logs,
	68	+accounts and entries, and says nothing about a mailing list.
	69	+
46	70	## Existing race service
47	71
48	72	`resources/functions/race-api.ts` talks to the existing `https://api.lastsoulultra.com/v1` service for public events, sign-in, profile updates and entry requests. Its established bearer session remains under `lsu.runner.session`. Coaching has its own HQ account session; credentials are never silently transferred or linked by unverified email. Form submissions reach the real race service, so use an approved test account/service for write testing.