Feature set 179.

[jackfperryjr]

Every page now loads its CSS and JS from its own file. Nothing is left inline.

page	was	now	extracted to
wwwroot/index.html	1364	289	assets/home.css, assets/home.js
games/index.html	386	100	games/style.css, games/hub.js
kupodle/index.html	391	73	kupodle/style.css
sphere-hunter/index.html	383	88	sphere-hunter/style.css
battle-square/index.html	407	116	battle-square/style.css
triple-triad/index.html	271	71	triple-triad/style.css
Dashboard/index.html	1657	163	Dashboard/app.css, Dashboard/app.js
Stats/index.html	757	168	Stats/app.css, Stats/app.js

Page-specific files sit beside the page, the way game.js already did; the root page has no
directory of its own, so it uses assets/home.*. Every reference carries a ?v= stamp, since
Cloudflare overrides the origin's no-cache on .js and .css.

Scripts are wrapped in an IIFE with 'use strict', matching theme.js and three of the four
game.js files. The home page's five inline on* handlers became addEventListener calls in
home.js — they resolve against the global object and could not have survived the move into a
scope. No other page used them.

Dashboard and Stats sit outside wwwroot, so UseStaticFiles never sees them: their CSS and JS
get explicit routes behind the same Dashboard authorization policy as the pages, plus Content
entries in the csproj so they reach the output directory. Serving them off wwwroot instead
would have left the markup private and its behaviour public.

Also adds the strip and wordmark art: character/monster octagons, game circles (now bordered to
match), and the two logo lockups.

Verification

• Diffed every extraction line by line against main: all 3,908 original CSS/JS lines are present verbatim.
• node --check on all four extracted scripts.
• Ran the app against a local database and fetched every page and asset: all six public pages 200
  with every referenced stylesheet and script resolving 200; /dashboard/app.* and /stats/app.*
  302 to the OAuth challenge, same as their pages; no served page contains an inline block.
• dotnet build -c Release and dotnet format --verify-no-changes both clean.

Not covered: the dashboard and stats pages rendered while signed in — that needs a real Google
sign-in. Their assets are confirmed routed and guarded.

🤖 Generated with Claude Code