Stage the ACannons browser build at /cannons

A third instance of the pattern notebooks-export/ and the reading payloads
already use: an artifact built somewhere with a toolchain this repo's
node:24-slim container does not have, dropped into a gitignored directory,
staged into public/ by a script, and picked up by auto-build.sh's signature on
the next tick. Nothing here needs a JDK, Go, or an opinion about the game --
cannons_reloaded's deploy/export-cannons.sh hands over a directory that is
already ready to serve.

Three things are load-bearing and easy to get wrong later:

The payload is at /cn/, not /cannons/. With build.format:'file' the page
builds to cannons.html, and try_files would then have a file and a directory
competing for the same URL. That is exactly why the notebook exports live at
/nb/ and not under /notebooks/.

nginx gets gzip_static for /cn/. nginx:alpine has `gzip on` commented out in
its base config, so without it the page ships 9MB instead of 3.3MB and nothing
anywhere reports that. It gets no-cache rather than an expiry, because
classes.js and cannons.wasm are stable filenames whose contents change on
every rebuild -- a long expiry would pair a stale client with a fresh server.

The page loads on click, not `loading="lazy"`. Lazy only defers until the
frame nears the viewport and this frame is above the fold, so a few MB would
download for anyone who opened the page to read the paragraph.

A missing export is a normal state throughout: copy-cannons.mjs stages
nothing, the page says so, and the sidebar link does not appear.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S4wdbGSVzvUDHBWRjSVxfr

deploy/auto-build.sh

@@ -30,6 +30,12 @@ sig=$({
     git diff
     find "$VAULT" -name .obsidian -prune -o -type f -printf '%T@ %p\n' | sort
     find "$REPO/notebooks-export" -type f -printf '%T@ %p\n' 2>/dev/null | sort
+    # the ACannons export: gitignored like the notebooks, written by a Gitea
+    # Action on cannons_reloaded rather than a timer here. Its own clause for
+    # the reason spelled out below -- with `-o` the -printf binds only to the
+    # LAST clause, so folding this into an OR-chain would silently print the
+    # other matches in a different format and stop the signature being stable.
+    find "$REPO/cannons-export" -type f -printf '%T@ %p\n' 2>/dev/null | sort
     # same deal for every reading map payload: gitignored, written by library-rag-export.service
     # on its own timer, so git status/diff above cannot see them change. One glob rather than a
     # list — with `-o` the `-printf` binds only to the LAST clause, so an OR-chain silently

deploy/nginx.conf

@@ -24,6 +24,22 @@ server {
         add_header Cache-Control "public";
     }
 
+    # The ACannons browser build. gzip_static serves the .gz siblings that
+    # export-cannons.sh writes, which is the difference between 3.3MB and 9MB
+    # on the wire; nginx:alpine ships --with-http_gzip_static_module but has
+    # `gzip on` COMMENTED OUT in its base config, so without this the page
+    # would go out uncompressed and nothing would say so.
+    #
+    # no-cache, not `expires`: classes.js and cannons.wasm are stable
+    # filenames whose contents change on every rebuild, so a long expiry would
+    # serve a stale client against a fresh server until the cache aged out.
+    # The browser still caches them and revalidates, which is a 304 and a few
+    # bytes on an unchanged build.
+    location /cn/ {
+        gzip_static on;
+        add_header Cache-Control "no-cache";
+    }
+
     location /_astro/ {
         # content-hashed filenames — safe to cache hard
         expires 365d;