Publish and verify the public Stacks game site

Current scope: publish and maintain the already deployed Stacks application at https://the-settlers-remake.stacksjs.com. The server application, guest demo, authenticated game and original-media web channel supersede the historical static-only plan below, as recorded in the 2026-10-30 implementation comment and docs/content/permissions/. Those owner decisions are not rights-holder grants.

Current acceptance:

• Public HTTPS home has the correct title, a guest demo, original-game credit and a readable mobile layout. Direct live HTTP and five real Chrome viewport checks passed on 2026-11-01.
• Attachment and domain are read from protected deployment configuration, without publishing host identity.
• Local and CI browser acceptance exercise guest play, sign-in gating and registration in a disposable environment.
• Run the maintained deployment workflow with its post-cutover public page, decoded-image and sign-in-gate checks, retaining the actual run and rollback outcome if triggered.
• Retain regressions for invalid pages, missing routes, corrupt or truncated images, and an incorrect or bypassed game redirect.

Related: #103, #25, stacksjs/stacks#3083. The production deployment and post-cutover smoke gate passed in run 41387712090 (https://github.com/stacksjs/the-settlers-iii-remake/actions/runs/41387712090). Full native and Gold Edition qualification remain separate.

Historical original scope (preserved):

A public landing page lives in site/ and is declared as the only deployed site in config/cloud.ts. It carries no original media, because redistribution rights are unverified (bun run publication:check --channel web) and the playable game therefore cannot be published yet.

Acceptance:

• site/ is served at https://the-settlers-remake.stacksjs.com with working TLS, the page title and a readable mobile layout.
• The deploy attaches to the shared Stacks box through CLOUD_ATTACH_TO supplied by the encrypted production environment or a protected CI secret. No host, address or token appears in tracked files.
• DNS for the subdomain exists and the deploy workflow's post-deploy smoke check requests the live page.
• A unit regression keeps original media, em-dashes and server names out of the public site and config (tests/unit/cloud-config.test.ts).

Related: #103 (finished release), #25 (adopt published foundation releases). The playable game stays off the public site until a reviewed grant exists in docs/content/policy.ts.

Static site added in 6218193 (site/, declared as the only deployed site in config/cloud.ts, guarded by tests/unit/cloud-config.test.ts). Deployment is blocked on protected-environment configuration that does not exist yet in this repository: secrets DEPLOY_SSH_KEY, DOTENV_PRIVATE_KEY_PRODUCTION, HCLOUD_TOKEN, PORKBUN_API_KEY/PORKBUN_SECRET_KEY (or Cloudflare) and variables CLOUD_ATTACH_TO, APP_DOMAIN on the production environment, plus an encrypted .env.production. A local buddy deploy --prod --dry-run resolves the plan (attached server, routes, DNS, TLS). Linked: stacksjs/stacks#3083, stacksjs/stx#2139.

The site is live at https://the-settlers-remake.stacksjs.com as a Stacks server app (views plus API) attached to the shared server, replacing the earlier static page.

Evidence (2026-10-30):

• /, /login, /register, /credits, /terms, /privacy, the showcase images and the converted original media return 200; /play redirects a signed-out visitor to /login?next=/play.
• The home page has a guest-playable demo (no account, never saved). On the live site a woodcutter was placed from the keyboard and built by settlers, spending real planks and stone.
• Locally and in the browser acceptance suite (tests/browser/home.ts): the demo, the sign-in gate and real registration through the form landing in /play.
• Credit to Blue Byte and Ubisoft appears in every footer, every screenshot caption, the in-game guide and /credits. The owner decisions behind the web and github-release channels are recorded under docs/content/permissions/ and are not permission from the rights holders.
• Release v0.0.1 was cut and its workflow passed the github-release publication check.

Not verified: registration on production itself (kept to local and CI environments). Upstream defects found on the way: stacksjs/stx#2140 and stacksjs/stx#2141.

Deployed exact source db1029e through the existing protected production workflow. Deploy run 41387712090 completed successfully on 2026-11-01, including media publication checks, encrypted configuration validation, cutover, and the new public smoke gate. Rollback was correctly skipped because the deployment and smoke steps passed.

Independently repeated all ten live public checks after deployment: seven HTML routes, both real decoded 1440x900 showcase WebP images, and the signed-out /play 302 redirect to the same origin's login page with next=/play. No production account was created.

Local acceptance passed all 482 unit tests / 85,739 assertions, lint, app/tools/STX types, frozen installation, assets, production build, and the actual home/demo/registration browser flow using a disposable local database. Responsive Chrome checks passed 320,428,768,1280 and 1920px widths. The code and retained local receipt are in the linked source commit.

This completes the current server-application scope, which supersedes the preserved historical static-only plan. Original Gold fidelity, native integration, and rights-holder redistribution grants remain separate work. Stacks host privacy follow-up #3083 also remains open.