feat(web): the page spawns the worker, opens a demo, and reads a key

Three pieces of the standalone deployment, all in web/.

improvise-djm — app.js picks its peer instead of assuming a socket. The
wasm bundle is the same artifact either way (improvise-xks6), so the
difference is confined to one factory: `?ws=` selects the websocket, its
absence spawns `new Worker('./worker.js?doc=&seed=', {type:'module'})`.
The websocket path is KEPT, because improvise-ws-server is how a
TUI-hosted document is shared and nothing else can reach it; the presence
of the parameter is the whole selection mechanism, since a second knob
naming the same fact is a second thing to get wrong.

improvise-bck — web/demo.improv, built against an assertion rather than
by flipping an axis. examples/demo.improv leaves Customer/Date on None,
so every cell is an Aggregate and nothing is editable. The new demo puts
exactly one category on each visible axis (Product on row, _Measure on
column, Quarter on page) and carries Profit = Revenue - Cost, so a
visitor sees the formula move beside the cell they typed in, with no
keystroke and no scrolling. Two tests hold it: tests/web_demo_model.rs
projects the whole grid through grid_of and asserts every CellId is
Record (ADR 002 — that is what `editable` means), and post_message.rs
drives the shipped bytes through the real seed -> VFS -> open -> Snapshot
chain. The first was proved discriminating by pointing it at
examples/demo.improv, where it names the aggregate at (0,0).

One category per axis is asserted too: GridCache slash-joins a
multi-level tuple (gotcha 44), so a second category on an axis puts that
known gap on the front page.

improvise-hwpi — all four. A keydown listener on window feeds
Client::on_key_event, so the classifier is reachable at last; a frame
that will not fold now writes to #status instead of only the console; the
socket has an error listener, so "not running" no longer reads like
"still connecting"; and close() has a re-entry guard. Plus one the ticket
could not have predicted: a worker whose start() rejects is caught inside
worker.js and fires no `error` on the main thread, so the same silence
was about to be rebuilt in the new path — a first-frame watchdog covers
both deployments, because "the peer never answered" is the one condition
that means the same thing on each.

Verified: cargo test --workspace 1159 passing (1155 + 4), clippy clean,
fmt clean, actionlint clean, ./web/build.sh end to end (345 KB / 123 KB
gzipped client, 1.33 MB / 498 KB gzipped worker), every call present in
the generated .d.ts with the right arity, every relative reference in the
assembled site resolving. NOT verified: there is no browser here. No line
of JavaScript in this commit has ever run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EoW5BB87ZZdm96SvBTWawH

web/build.sh

@@ -22,14 +22,17 @@ wasm-pack build "$root/crates/improvise-worker-server" \
   --target web --out-dir "$root/web/worker-pkg"
 cat <<'MSG'
 
-Built. To run the thin client against a real server:
+Built. Serve the directory and open it — that is the whole application:
 
-  improvise-ws-server your-model.improv --port 8787
   python3 -m http.server 8080 --directory web
 
-then open http://127.0.0.1:8080/ (override the socket with ?ws=ws://host:port).
+then open http://127.0.0.1:8080/. The document lives in an in-page Web
+Worker and persists to this browser's private storage (OPFS). It is seeded
+on first load from web/demo.improv; ?doc= and ?seed= name other documents.
 
-worker-pkg/ is built and web/worker.js will load it, but nothing instantiates
-that worker yet: the main-thread bootstrap that spawns it and wires the
-MessageChannel is improvise-djm. Until then the worker bundle ships unused.
+To point the same page at a separate server process instead:
+
+  improvise-ws-server your-model.improv --port 8787
+
+then reload with ?ws=ws://127.0.0.1:8787.
 MSG