docs: the landing page is the front door, the app moves to /app/

User ruling on improvise-kh8, overturning the arrangement the previous commit
shipped: "The landing page should be served at the root of the repository and
link to the in-browser demo." The argument for the other arrangement is left
standing in the ticket rather than deleted — it is overruled, not wrong to have
considered — and the root is now `docs/index.html`.

The app moves under `app/` WHOLE, both bundle directories included. Every path
in `app.js` and `worker.js` is relative, so moving the bundle together keeps
every one of them correct and the wasm-pack generated glue untouched;
`worker.js`'s `fetch("demo.improv")` resolves against the worker's own URL, so
the seed follows for the same reason. The four `stamped` guards in
`assemble.sh` follow the files: they are the only check that the cache-bust
substitution worked, and a guard aimed at a path nothing writes fails in the
direction that looks like success.

`harness/tests/shell.spec.js` navigates to `/index.html` six times, including
the `?ws=` and `?doc=` variants, and every one of those now lands on the
landing page. All six are repointed at `/app/index.html`. That file is outside
this unit's declared scope and is the second deliberate stray in this PR.

VERIFIED AGAINST THE ASSEMBLED TREE, not against `docs/` directly, because a
path move is what re-arms the trap this page already caught once. With real
bundles from `web/build.sh`:

  * `npx playwright test tests/shell.spec.js --project=chromium` — 6 passed,
    with `/app/{index.html,app.js,style.css,worker.js,demo.improv}` and both
    `?v=` stamped bundles all served 200;
  * the four casts play 37 lines each at the site root, no failed request and
    no page error;
  * the full journey: load the root, click the call to action, land on `/app/`,
    and the grid draws out of the in-page worker — 12 cells, all editable,
    a "Revenue" header, `#status` reading "in-page worker · demo.improv".

The call-to-action check was proved able to fail by pointing the link at
`./aap/`: 404, while the page still looks entirely correct.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

README.md

@@ -179,13 +179,16 @@ improvise script setup.txt -f model.improv
 
 ## In the browser
 
-The browser page is at **<https://fiddlerwoaroof.github.io/improvise/>**, built
-and published from `main` by the `pages-build` / `pages-deploy` jobs in
+The browser page is at **<https://fiddlerwoaroof.github.io/improvise/app/>**,
+built and published from `main` by the `pages-build` / `pages-deploy` jobs in
 `.github/workflows/ci.yml`. A deploy only happens after `cargo test`, the
 wasm32 check and the Playwright browser harness have passed.
 
-A separate landing page with recorded terminal casts is served beside it at
-**<https://fiddlerwoaroof.github.io/improvise/landing/>**, from `docs/index.html`.
+The site **root** is the landing page — `docs/index.html`, with the recorded
+terminal casts — and it links to the app. `web/assemble.sh` puts the two
+together, which is why the app sits under `app/` rather than at the root: every
+path in `app.js` and `worker.js` is relative, so the bundles move with it and
+the generated wasm-pack glue needs no editing.
 
 **It needs no server.** The page is still a thin client — it holds no model,
 and every question about a cell, its text and whether it may be typed into, is
@@ -372,7 +375,7 @@ browser can satisfy is checked against `web/app.js`, which opens
 `new WebSocket(url)` and can therefore send no header. Verify the deny actually
 denies before trusting it with a document.
 
-Then, from <https://fiddlerwoaroof.github.io/improvise/>, reload with
+Then, from <https://fiddlerwoaroof.github.io/improvise/app/>, reload with
 `?ws=improvise.example.com`. Caddy preserves the request path, so the
 multi-document form works too: serve several files and name one with
 `?ws=improvise.example.com/bank-info`.