Tor ops: launch UI, onion list/health scripts, systemd installer, README glow-up

- Replace fake-site footer with dark-web launch CTA; fix HubChatter inside AppProviders (client crash)
- Add /launch, DEPLOY.md, onions:list|status|health, list-onion-urls, install-systemd, onion-status
- start.sh CYBERLUX_PREPARE_ONLY; copy pass on satellite pages; Navbar launch link
- README: operator cheat sheet, phone Tor note, systemd via install-systemd.sh

Made-with: Cursor

DEPLOY.md

@@ -0,0 +1,91 @@
+# CyberLux — production on Tor (.onion)
+
+This app is designed to run **behind nginx on loopback**, with **one Tor v3 hidden service per logical site** (hub, wiki, dedicated verticals, shadow `/w` node). Nginx listens on `127.0.0.1:8080–8122` (see `scripts/onion-nodes.json`); Tor forwards port 80 on each onion to the matching loopback port. **Next.js binds only `127.0.0.1:3000`** — never expose 3000 or the nginx loopback ports to the public internet.
+
+Onion hostnames are **created locally** when Tor first starts; there are no fixed `.onion` URLs in the repo. Back up `/var/lib/tor/*/hs_ed25519_secret_key` (the install flow uses `scripts/backup-onion-keys.sh`).
+
+## One-time server setup (Debian/Ubuntu-style)
+
+```bash
+sudo apt update
+sudo apt install -y tor nginx curl nodejs npm build-essential
+# Or install Node.js LTS from NodeSource / nvm — `node` and `npm` must be on PATH.
+```
+
+## Deploy the app
+
+From the repo root (as the user that will own the process):
+
+```bash
+./start.sh
+```
+
+This will: regenerate Tor/nginx maps from `scripts/onion-nodes.json`, `npm install`, `npm run build`, install Tor+nginx configs (`sudo`), wait for hostname files, print every `.onion` URL, then **foreground** `next start` on `127.0.0.1:3000`.
+
+For a **one-shot prepare** (build + Tor/nginx, no Next.js — for systemd):
+
+```bash
+CYBERLUX_PREPARE_ONLY=1 ./start.sh
+```
+
+## systemd — start on boot
+
+1. Ensure `./start.sh` or `CYBERLUX_PREPARE_ONLY=1 ./start.sh` has been run at least once so `.next` exists and Tor directories are populated.
+2. Install the unit (run as root; set user to the account that owns the repo):
+
+```bash
+sudo CYBERLUX_USER=youruser bash scripts/install-systemd.sh
+# optional: sudo CYBERLUX_CHOWN_REPO=1 CYBERLUX_USER=youruser bash scripts/install-systemd.sh
+```
+
+3. Enable **Tor**, **nginx**, and **CyberLux** at boot:
+
+```bash
+sudo systemctl enable tor.service nginx.service cyberlux.service
+# if your distro uses tor@default instead of tor:
+# sudo systemctl enable tor@default.service nginx.service cyberlux.service
+sudo systemctl start tor.service nginx.service cyberlux.service
+```
+
+4. Check logs:
+
+```bash
+journalctl -u cyberlux.service -f
+```
+
+5. Health check (local):
+
+```bash
+npm run health:stack
+```
+
+6. **List every `.onion` URL** and **check that each nginx loopback vhost answers** (needs Tor running; use `sudo` if hostname files are root-only):
+
+```bash
+npm run onions:status
+# or:
+sudo node scripts/onion-status.cjs
+```
+
+## Changing the onion map
+
+1. Edit `scripts/onion-nodes.json`.
+2. Run `node scripts/generate-onion-config.cjs` (or `npm run build`, which runs it in `prebuild`).
+3. `sudo bash scripts/install-tor-onion.sh`
+4. Rebuild/restart the app: `npm run build` and `sudo systemctl restart cyberlux.service`
+
+## Verification
+
+```bash
+npm run verify
+```
+
+## Security & compliance
+
+- You are responsible for **local law**, hosting terms, and **Tor / relay policies**. This repo is a **parody web app**; treat operational security seriously if you run it on a real server.
+
+## Security notes
+
+- Only **Tor** should be reachable from outside; bind **nothing** to `0.0.0.0` for this stack.
+- Prefer firewall defaults that deny incoming except what you need for SSH.
+- Optional: `sudo bash scripts/classroom-ufw.sh` (if present) for a restrictive UFW profile.