feat(generators): offline data pack generators at generators.

Add generators.${BASE_DOMAIN}: a pinned fork of misode.github.io served
with its own mcmeta + vanilla-mcdoc mirror, so it works with zero internet
at the LAN party. Fork lives in ulicraft-generators (branch ulicraft),
pinned at upstream 2bfe5522.

The app is 100% client-side: every data fetch comes from the player's
browser, not from cochi. So offline capability is entirely about which
origins the bundle refers to, plus a mirror to serve them from. The vhost
sets Content-Security-Policy with connect-src 'self' as ENFORCEMENT: an
external origin that sneaks back in (or returns via an upstream merge)
then breaks loudly in prod, on an ordinary day, instead of silently at the
venue with no internet to debug it.

sync-generators-data.sh mirrors ~109M: the 1.21.1 summary/data/atlas tags,
assets-tiny (assets minus hundreds of MB of .ogg — hence no sounds
generator), vanilla-mcdoc symbols.json, and summary/versions/data.min.json,
which comes from a BRANCH head rather than a version tag and runs during
Spyglass init. It verifies a sentinel file per source instead of trusting a
clean clone exit, since a renamed upstream path would otherwise sync
"successfully" and only fail in the browser at the party.

The container serves the bundle and the mirror on one origin, so there is
no CORS, no second cert and no second DNS name.

DEPLOY ORDER MATTERS. GENERATORS_REPO must be set in cochi's .env BEFORE
pulling this: compose uses ${GENERATORS_REPO:?...}, and an unset required
variable makes docker compose fail to parse the file — taking down every
service including Minecraft, not just this one. Full runbook and the rest
of the prerequisites: plan/21-generators.md.

Verified offline in real Chromium with every non-origin request aborted:
zero off-origin attempts, zero same-origin failures, zero console errors,
generators rendering schemas and live JSON.

.env.example

@@ -95,6 +95,21 @@ FILES_SECRET_KEY=
 # server-side; players never see it. openssl rand -hex 24.
 FILES_LOCAL_SECRET=
 
+# ── generators.${BASE_DOMAIN} — offline Minecraft data pack generators ────
+# A pinned fork of misode.github.io, built from source and served with its own
+# data mirror so it works with ZERO internet at the LAN party. The app is 100%
+# client-side, so the mirror is what makes it offline-capable — not the fact
+# that the host has no WAN. Full design: plan/21-generators.md.
+
+# Absolute host path to the ulicraft-generators checkout (the fork). This is the
+# docker build context; the fork carries its own Dockerfile + Caddyfile.
+GENERATORS_REPO=/home/oier/projects/mc-mods/ulicraft-group/ulicraft-generators
+
+# Where tooling/sync-generators-data.sh puts the ~107M mcmeta + vanilla-mcdoc
+# mirror. Gitignored, fetched deliberately with WAN, mounted read-only.
+# Must be re-synced (with a matching MC_REF) if the pinned MC version moves.
+GENERATORS_DATA_DIR=./generators-data
+
 # Only needed if using CurseForge-exclusive mods:
 # CF_API_KEY=your-curseforge-api-key
 
@@ -102,7 +117,7 @@ FILES_LOCAL_SECRET=
 # Only needed to issue real TLS certs. DNS-01 needs no inbound ports.
 LE_EMAIL=you@example.com
 # space-separated subdomains; apex ${BASE_DOMAIN} is always included
-LE_SUBDOMAINS=auth distribution www avatar status files
+LE_SUBDOMAINS=auth distribution www avatar status files generators
 # OVH API creds (DNS zone write). Create at https://eu.api.ovh.com/createToken/
 # OVH_CK can be blank on first run — acme.sh prints an auth URL, then paste it.
 OVH_END_POINT=ovh-eu