chore: checkpoint web Blender migration source, tools and docs

Accumulated uncommitted work: GHOST Web backend, WebGL/GPU web layer,
web workflow engine and protocol, tooling, docs and task records.
Large generated evidence, user-testing archives, build snapshots and
imported test assets remain untracked.

Co-Authored-By: Claude Code <noreply@anthropic.com>

tools/web/check-deployment-http.mjs

@@ -178,6 +178,17 @@ try {
   assert.notEqual(changed.headers.get("etag"), etagFirst);
   assert.deepEqual(await body(changed), replacement);
 
+  const privatePassword = crypto.randomBytes(24).toString("hex");
+  const privateServer = createDeploymentHttpServer({ root, contract, accessUsername: "test-owner", accessPassword: privatePassword });
+  const privateOrigin = await listenDeploymentHttpServer(privateServer), privateHeaders = { Authorization: `Basic ${Buffer.from(`test-owner:${privatePassword}`).toString("base64")}` };
+  try {
+    assert.equal((await fetch(privateOrigin)).status, 401);
+    assert.equal((await fetch(privateOrigin, { headers: { Authorization: "Basic invalid" } })).status, 401);
+    for (const route of ["server-operator-job", "blender-workflow", "blender-session", "blender-resources"]) assert.equal((await fetch(`${privateOrigin}/api/${route}`, { method: "POST" })).status, 401);
+    const authorized = await fetch(privateOrigin, { headers: privateHeaders }); assert.equal(authorized.status, 200); assert.equal(authorized.headers.get("cache-control"), "private, no-store"); assert.equal(authorized.headers.get("vary"), "Authorization"); assert.deepEqual(await body(authorized), fixtures.get("/index.html"));
+    assert.equal((await fetch(`${privateOrigin}/api/server-operator-job`, { method: "POST", headers: { ...privateHeaders, Origin: "https://untrusted.invalid" } })).status, 403);
+    await assert.rejects(listenDeploymentHttpServer(createDeploymentHttpServer({ root, contract, accessPassword: "" }), { host: "0.0.0.0" }), /WEB_BLENDER_PASSWORD/);
+  } finally { await new Promise((resolve) => privateServer.close(resolve)); }
   process.stdout.write("deployment-http-ok mime=10 head=4 ranges=5 invalidRanges=6 resumeSha256=verified\n");
 }
 finally {