Harden onion boot flow and deepen site surfaces

Add persistent onion key backup and restore, improve startup resilience, and flesh out the major site verticals with richer navigation, search coverage, and operator documentation.

Made-with: Cursor

scripts/fix-next-perms.sh

@@ -0,0 +1,26 @@
+#!/usr/bin/env bash
+# Fix root-owned .next (e.g. after sudo npm run build). From repo root:
+#   sudo bash scripts/fix-next-perms.sh
+#
+# Optional: pass a different path as first arg (default: REPO/.next)
+
+set -euo pipefail
+[[ "${EUID}" -eq 0 ]] || { echo "Run with sudo."; exit 1; }
+
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+TARGET="${1:-$REPO/.next}"
+
+# Under sudo, prefer the user who invoked sudo
+if [[ -n "${SUDO_USER:-}" ]]; then
+  u="$SUDO_USER"
+  g="$(id -gn "$SUDO_USER" 2>/dev/null || echo "$SUDO_USER")"
+elif [[ -n "${SUDO_UID:-}" ]]; then
+  u="$(id -nu "$SUDO_UID")"
+  g="$(id -gn "$SUDO_UID")"
+else
+  echo "Could not determine target user. Run: sudo chown -R youruser:youruser $TARGET"
+  exit 1
+fi
+
+chown -R "$u:$g" "$TARGET"
+echo "Ownership reset to $u:$g for $TARGET"