site generator: commands/*.md with front matter -> k8s/site/

- build/build.mjs: one-file-per-command content (filename = command,
  underscores = spaces; help/suggestion/params/prefix/text/hidden in
  front matter; ${args} ${date} ${time} ${ls} ${help} resolved at runtime)
- generates index.html (banner + chips), commands.json (the single data
  source), hello.txt for curl, style.css via tailwind v4
- src/site.js is now dispatch-only over commands.json; typewriter kept
- src/telnet.py: stdlib telnet shell sharing commands.json
- k8s: python telnet sidecar in the pod + LoadBalancer service 23->2323
- .gitea/workflows/site.yml fails CI when k8s/site/ is not the built output

k8s/deployment.yaml

@@ -63,6 +63,41 @@ spec:
             readOnlyRootFilesystem: true
             capabilities:
               drop: ["ALL"]
+        # the telnet shell — same commands.json as the website, stdlib python
+        - name: telnet
+          image: docker.io/library/python:3.14-alpine@sha256:7f2ec713f0436c59df2362d973b6a05af9e87ba78f0e94f5245c302984a7a1fd
+          command: ["python", "-u", "/app/telnet.py"]
+          env:
+            - name: TELNET_PORT
+              value: "2323"
+          ports:
+            - name: telnet
+              containerPort: 2323
+          volumeMounts:
+            - name: telnet
+              mountPath: /app/telnet.py
+              subPath: telnet.py
+              readOnly: true
+            - name: site
+              mountPath: /app/commands.json
+              subPath: commands.json
+              readOnly: true
+          startupProbe:
+            tcpSocket:
+              port: telnet
+            failureThreshold: 30
+            periodSeconds: 2
+          resources:
+            requests:
+              cpu: 10m
+              memory: 48Mi
+            limits:
+              memory: 96Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
       volumes:
         - name: site
           configMap:
@@ -70,5 +105,8 @@ spec:
         - name: config
           configMap:
             name: config
+        - name: telnet
+          configMap:
+            name: telnet
         - name: tmp
           emptyDir: {}