Basic auth came off flutter3d.pleion.dev today, and the first public load
found all three demos dead: nginx's stock mime.types predates `.mjs`, so
`main.dart.mjs` went out as application/octet-stream and the browser's
strict MIME check refused the module. One `types` override in the vhost
and the games boot.

The second thing the first load found was silence. flutter_soloud on the
web needs two script tags no app's `index.html` carried, its wasm module
needs `SharedArrayBuffer` — the site now serves COOP/COEP site-wide,
which is also what lets skwasm run multi-threaded — and even wired up,
the module initialises after `main` is already running, so the first
`init` threw into the fallback-to-silence and every game played mute.
`SoLoudBackend.open` now waits the race out: up to five seconds of
patient retries before the last error is allowed through.

The template app gains the `web/` directory it never had, with the two
script tags and the comment that explains them — a game grown from the
template should get web audio on day one rather than rediscover this.
The site docs record the vhost's two load-bearing headers and how the
auth comes back if it must; `flutter3d_audio`'s 0.4.0 changelog entry
stops claiming the release changed nothing, and the tag moves to match.