Add landing page + Caddy download host (site/)

Self-contained, no-JS landing page (tinygrad-minimal) that doubles as the
artifact download host, served by Caddy on an internal :80 box.

- site/index.html: static page, "Same tool, only a little different", feature
  highlights (remote->remote, symmetric panels, ssh_config awareness, edit-in-
  place, self-copy guard, ...), fixed stable download links, FAQ (unsigned notes).
- site/Caddyfile: one flat /dl/ folder with browse + range requests and per-type
  Cache-Control (patches immutable, update.json no-cache, installers short).
- site/deploy.sh: drop a build's artifacts/stable-* into /dl/ (renames the win
  portable zip to a stable name).
- Flat folder matches electrobun's artifacts/ layout, so it's also the future
  updater baseUrl; per-build folders/symlink dropped in favor of it.
- docs/build-and-release.md: document the download host + deploy flow.

Verified: caddy validate + live smoke test (links, cache headers, 206 range,
404 fallback, deploy.sh copy/rename) against a temp root.

Co-Authored-By: Claude <noreply@anthropic.com>

docs/build-and-release.md

@@ -67,6 +67,31 @@ runner matrix, each running the same release script; inert until act_runners
 with those labels are registered. Needs `fetch-depth: 0` (the build number is
 the commit count). Runner prereqs are commented in the workflow file.
 
+## Download host (`site/` + Caddy)
+
+`site/` is a self-contained landing page **and** download host, served by Caddy on an
+internal box (plain HTTP `:80`, no domain/TLS). Deploys to `/srv/miniscp/`.
+
+- `site/index.html` — pure static, no JS, tinygrad-minimal. Download buttons link to **fixed
+  stable filenames** (`/dl/stable-macos-arm64-miniSCP.dmg`, …) so the page never changes per
+  release. Logo/screenshot `<img>` slots are commented in, images live in `site/assets/`.
+- `site/Caddyfile` — one flat `/dl/*` folder with `file_server browse` + range requests, and
+  per-type `Cache-Control`: `*.patch` immutable (unique hashed names), `*update.json` `no-cache`
+  (updater must see new versions), installers (`*.dmg *.zip *.tar.zst`) `max-age=300` (stable
+  names overwritten each release). Landing page has **no** SPA fallback → unknown paths 404.
+  Path matcher gotcha: use suffix globs like `*update.json`, not `*/*update.json`.
+- **One flat folder, no per-build dirs** — this layout IS electrobun's `artifacts/` feed, so it
+  doubles as the (future) updater `baseUrl`. Publishing = drop this machine's `artifacts/stable-*`
+  into `/dl/`; installers overwrite in place, `.patch` files accumulate (never delete them, or
+  older installs lose their incremental-update trail). **Tradeoff:** only the latest full
+  installer is downloadable; old full versions are overwritten.
+- `site/deploy.sh` — run per build machine after `scripts/release.ts`; copies `artifacts/stable-*`
+  and renames the build-numbered win portable zip to the stable `stable-win-x64-miniSCP-portable.zip`.
+  `MINISCP_DL_DIR` overrides the target (stage locally, then rsync to the server).
+- **Future updater** (not wired yet): set `release.baseUrl = http://<host>/dl/` in
+  `electrobun.config.ts` (currently unset) → builds start emitting `.patch` files that `deploy.sh`
+  already ships. Then call the electrobun `Updater` API on launch/interval/tray.
+
 ## Icons
 
 `scripts/gen-icons.ts` (resvg, dev-time): renders `assets/logo.svg` into the