Serve the document from a Django backend, split into three tiers

Step 9. The tier split was the work; Django was the easy half.

Tier 1 — the authored scene — is the document, and it is addressed as
independently versioned leaves rather than saved whole, so one vertex drag
cannot clobber a collaborator's keying. `domain/leaf` is the document as
path -> value; `domain/wire` puts it on the wire as transit, because JSON
has neither integer map keys nor keywords and a save would quietly turn
`{0 v}` into `{"0" v}`.

Tier 2 — the dense channel blocks — is content-addressed by a hash over
every input, with the detector version inside every key through the
analysis the block descriptor names. `flow/address`'s `block-knobs` is the
invalidation table, and `address-test` does not trust it: it re-freezes the
take once per knob and asserts the biconditional, that a block's bytes
changed if and only if its key changed. That found `brow-pos` not depending
on `contour-avg` — the brow ring is smoothed, the raise is not.

Tier 3 — frames and audio — is served by the hash of its bytes out of the
same store. A manifest now names frames and carries a URL for each, so the
frame layout stopped being a shared secret between a shell script and a
ClojureScript namespace, and the `?v=` cache-buster went with it: a blob's
name is the hash of its contents, so a stale copy is not a thing that can
happen. The synthetic take's `audio.wav` moved to `static/arthur/` — an
asset the project owns, not an extraction that churns.

The server verifies rather than trusting a name it was handed: it
recomputes every key from the descriptor stored beside it, refuses an
analysis that declares no detector version, and refuses a document naming
blocks it does not hold. It hashes the descriptor TEXT, because JS prints
an integral double as `1` and Python as `1.0`, and a scheme where both ends
re-render the numbers disagrees on the first parameter that happens to be
whole.

Two loose ends from step 8 closed on the way. `pack` no longer takes a
`(track, frame)` predicate whose call sites each re-derived a feature from
an index — every track names the feature it follows, which deleted five
hand-maintained mappings. And `:dev-http` is gone: Django serves the page,
shadow-cljs only builds into the staticfiles tree.

227 CLJS tests, 31 Django tests, green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/animation-model.md

@@ -93,7 +93,18 @@ frames where that feature is occluded and later reappears:
  :eye-l {:id :eye-l :subject :face-1 :area :eye
          :nodes [:eye-l :eye-l-in :iris-l :pupil-l] :params {}}
  :mouth {:id :mouth :subject :face-1 :area :mouth
-         :nodes [:mouth :mouth-in :teeth] :params {}}}
+         :nodes [:mouth :mouth-in] :params {}}
+ ;; The teeth are their OWN feature and not three nodes of the mouth. A feature
+ ;; carries the params of exactly one area, and the teeth have an `:area :teeth`
+ ;; of their own — the otsu threshold, the tongue rejection, the radial contour's
+ ;; vertex budget — which could not be reached if they were part of `:mouth`.
+ ;; The coupling that made them look like the mouth's is real and is enforced
+ ;; elsewhere: `:teeth` is STENCILLED by `:mouth-in`, and a node whose stencil drew
+ ;; nothing is dropped, so an absent mouth takes the teeth with it without either
+ ;; of them sharing an absence mask. An earlier draft of this block listed them
+ ;; together; the code is right and this document was wrong.
+ :teeth {:id :teeth :subject :face-1 :area :teeth
+         :nodes [:teeth] :params {}}}
 :groups
 {:eyes-1 {:id :eyes-1 :kind :eye-pair :subject :face-1
           :members [:eye-r :eye-l] :params {}}}