API, Architecture, Development: the editor on feuerwerk.nockal.com

The same folder now answers on the subdomain as well, so the pages
no longer name /feuerwerk/ as the one fixed path.

- API: the session cookie has no Path, and the old /feuerwerk/
  cookie is cleared on every sign-in and sign-out.
- Architecture: site.ts takes the path from the folder of the page.
- Development: why the build has a relative base.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

API.md

@@ -78,7 +78,9 @@ still takes a session. See [Accounts](Accounts).
   `SameSite=Lax`, and to that every subdomain of the site is the same site. Tools send no such
   header.
 - **The cookie** carries `Secure` whenever the request reached the Brandmauer over HTTPS, along
-  with `HttpOnly` and `SameSite=Lax`.
+  with `HttpOnly` and `SameSite=Lax`. It has no `Path`, so the browser keeps it for the folder of
+  the API as it sees it: `/feuerwerk/api` on `nockal.com`, `/api` on `feuerwerk.nockal.com`. A
+  cookie from before, set for all of `/feuerwerk/`, is ended with every sign-in and sign-out.
 
 `tests/php/rights.test.php` runs the API under `php -S` on a scratch directory and asks every route
 as somebody signed out, as the owner, as another account and as an administrator. It also reads the

Architecture.md

@@ -193,7 +193,7 @@ src/core/recording/    recording (#405: what Start recording asks for and the ru
                        editorRecording (main menu → Start recording…: what the dialog offers and the size
                        and sharpness a choice comes out at), cursors + cursors/ (the mouse pointer an editor
                        recording draws, one SVG per shape with its hot spot)
-src/core/site.ts       the path the site is served under (`/feuerwerk/`, #422) and the data paths built from it
+src/core/site.ts       the path the site is served under (the folder of the open page: `/feuerwerk/` or `/`) and the data paths built from it
 src/core/soundfx/      the sound FX graph (#311): nodes (every effect and what it adds to a plan), compile (the
                        graph walked back from the Output to a plan; a parameter stays open until a voice
                        starts; a tapped node gets a `tap` in front and behind, #374), parametricEq (#367:

Development.md

@@ -287,7 +287,10 @@ he walks on the spot — a clock that ticks without the picture following would
 ## Deployment
 
 The workspace folder itself lies behind `https://nockal.com/feuerwerk/`, so `npm run build` is the
-deployment, and a change to `api/` is live the moment it is saved. nginx hands out only what the
+deployment, and a change to `api/` is live the moment it is saved. The same folder answers at
+`https://feuerwerk.nockal.com/`: the Brandmauer puts `/feuerwerk` in front of every path there.
+That is why the build knows no path of its own. Its base is relative, and `src/core/site.ts`
+takes the path of the API and the data from the folder of the open page. nginx hands out only what the
 pages load (#427), from a `location ^~ /feuerwerk/` block in the shared `nginx.conf` of the web
 stack: