feat: /secret — the grimoire

An unlisted page at /secret. Nothing in the app links to it, it has no nav
tab, and MobileNav's route-parity test now names it as an explicit exception
so an ordinary page still fails that test. It IS crawlable and is advertised
in the sitemap: "hidden" here means no button, not no index — a long,
specific mechanics page is worth the search traffic.

Every number on it was read out of the source or produced by RUNNING the
real function. A grimoire of plausible-sounding numbers would be worse than
none, because it would be believed. Four hand-rolled SVG figures (rarity by
moon phase, the passage ladder, the two twist curves) rather than a charting
dependency for four static pictures.

The best thing in it is a trap I did not know existed until I ran the code:
crossing over requires volatility strictly above 0.6, and favor shifts
volatility DOWN by up to 0.12 at mint. So a hunter at maximum favor pulls
spirits under the gate and locks themselves out of the largest reward in the
game — 25 essence and +0.08 favor. Verified directly: a spirit at volatility
0.65 is crossable at favor 0.0, and is not at +0.5 or +1.0. "Do not maximise
favor" is real, counter-intuitive, and follows from the source.

English only, as agreed — written as prose outside the i18n system rather
than several hundred translation keys, which keeps the en/es parity gate
meaningful for the actual UI.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/app/routes/seo.py

@@ -94,6 +94,13 @@ async def sitemap(db: AsyncSession = Depends(get_db)) -> Response:
         "<priority>0.9</priority></url>",
         f"<url><loc>{base}/shop</loc><changefreq>weekly</changefreq>"
         "<priority>0.7</priority></url>",
+        # /secret is UNLISTED, not private: nothing in the app links to it and
+        # it has no nav tab, so a seeker only finds it by being told. It is
+        # advertised here anyway because it is a long, specific mechanics page
+        # and search traffic is the whole reason it is crawlable — "hidden"
+        # here means "no button", not "no index".
+        f"<url><loc>{base}/secret</loc><changefreq>monthly</changefreq>"
+        "<priority>0.8</priority></url>",
     ]
     for entity_id, discovered_at in entities:
         loc = _xml_escape(f"{base}/codex/{entity_id}")