Harden server/sketch runner, prune dead code, add agent docs

[vecnode]

What & why

Production hardening pass over the app, removal of dead/demo code, and new contributor/agent documentation.

Hardening — src/main.cpp

• Request-size cap (5 MiB) enforced at the transport layer (set_payload_max_length) and inside the save handler (returns 413 rather than writing unbounded data to disk).
• Request timeouts — set_read_timeout(10s) / set_write_timeout(30s) so a slow or oversized client can't tie up the loopback server.
• No internal error leakage — /api/save-script previously returned ex.what() to the client; it now logs to stderr and returns a generic message.
• Charset on responses; explicit loopback-only comment; Asio thread is now joined on the early bind-failure return.

Hardening — public/script.js

• Tightened the sketch iframe sandbox from allow-scripts allow-same-origin → allow-scripts. User sketches now run in an opaque origin and cannot reach the local HTTP API, cookies, or storage. p5.js still loads and error reporting via postMessage still works.

Dead code removed

• Deleted the unused /api/hello endpoint.
• Removed the Boost.Asio heartbeat that spammed [asio] heartbeat to stdout every 5s. The io_context thread is kept as an idle infrastructure placeholder (per maintainer preference) with an explanatory comment.
• Replaced the broken build_and_distribute.bat (# To do is not a valid batch comment — it would error if run) with a clean documented stub.

Documentation

• AGENTS.md — canonical guide: architecture, HTTP route contract, sketch-sandbox + loopback security model, build/run, dependencies, gotchas.
• CLAUDE.md — points to AGENTS.md plus Claude/Windows-specific notes (kept DRY).
• README.md — rewritten for production (features, roadmap, prerequisites, build instructions, dependency table, layout, troubleshooting).

Reviewer notes

• Verified by reconfiguring and building the neo-processing Debug target on Windows/MSVC — compiles and links cleanly, and the re-embedded script.js is included. (The pre-existing build cache pinned an uninstalled Windows SDK; that was environment drift, fixed by reconfigure, unrelated to these edits.)
• No automated test suite exists; behaviour was verified by build.
• Do not re-add allow-same-origin to the sketch iframe or change the bind from 127.0.0.1 without a replacement isolation strategy.

🤖 Generated with Claude Code