feat(generators): offline data pack generators at generators.

Add generators.${BASE_DOMAIN}: a pinned fork of misode.github.io served
with its own mcmeta + vanilla-mcdoc mirror, so it works with zero internet
at the LAN party. Fork lives in ulicraft-generators (branch ulicraft),
pinned at upstream 2bfe5522.

The app is 100% client-side: every data fetch comes from the player's
browser, not from cochi. So offline capability is entirely about which
origins the bundle refers to, plus a mirror to serve them from. The vhost
sets Content-Security-Policy with connect-src 'self' as ENFORCEMENT: an
external origin that sneaks back in (or returns via an upstream merge)
then breaks loudly in prod, on an ordinary day, instead of silently at the
venue with no internet to debug it.

sync-generators-data.sh mirrors ~109M: the 1.21.1 summary/data/atlas tags,
assets-tiny (assets minus hundreds of MB of .ogg — hence no sounds
generator), vanilla-mcdoc symbols.json, and summary/versions/data.min.json,
which comes from a BRANCH head rather than a version tag and runs during
Spyglass init. It verifies a sentinel file per source instead of trusting a
clean clone exit, since a renamed upstream path would otherwise sync
"successfully" and only fail in the browser at the party.

The container serves the bundle and the mirror on one origin, so there is
no CORS, no second cert and no second DNS name.

DEPLOY ORDER MATTERS. GENERATORS_REPO must be set in cochi's .env BEFORE
pulling this: compose uses ${GENERATORS_REPO:?...}, and an unset required
variable makes docker compose fail to parse the file — taking down every
service including Minecraft, not just this one. Full runbook and the rest
of the prerequisites: plan/21-generators.md.

Verified offline in real Chromium with every non-origin request aborted:
zero off-origin attempts, zero same-origin failures, zero console errors,
generators rendering schemas and live JSON.

docker-compose.yml

@@ -160,6 +160,7 @@ services:
       - ./caddy/conf.d/40-avatar.caddy:/etc/caddy/conf.d/40-avatar.caddy:ro
       - ./caddy/conf.d/50-status.caddy:/etc/caddy/conf.d/50-status.caddy:ro
       - ./caddy/conf.d/60-files.caddy:/etc/caddy/conf.d/60-files.caddy:ro
+      - ./caddy/conf.d/70-generators.caddy:/etc/caddy/conf.d/70-generators.caddy:ro
       - ./www:/srv/www:ro
       - ./launcher:/srv/launcher:ro
       # Static site from ANOTHER repo (absolute host path in .env).
@@ -170,6 +171,36 @@ services:
         aliases:
           - "auth.${BASE_DOMAIN}"
 
+  # Minecraft data pack generators at generators.${BASE_DOMAIN} — a pinned fork
+  # of misode.github.io, built from source. caddy proxies generators. -> :80.
+  # Full design + the offline rationale: plan/21-generators.md.
+  #
+  # Built from the FORK's own checkout (GENERATORS_REPO), not from ./docker/,
+  # because the fork is not published yet — unlike nmsr, its Dockerfile cannot
+  # git-clone a pinned upstream ref. The fork carries its own Dockerfile+Caddyfile.
+  #
+  # The container serves the app AND the data mirror on one origin. That is the
+  # entire offline strategy: this app is 100% client-side, so every fetch comes
+  # from the player's browser. At the party there is no internet — anything
+  # off-origin is simply dead, which is why caddy/conf.d/70-generators.caddy
+  # enforces `connect-src 'self'`.
+  generators:
+    build:
+      context: ${GENERATORS_REPO:?GENERATORS_REPO unset in .env (path to the ulicraft-generators checkout)}
+      args:
+        # Must match the mcmeta ref mirrored into GENERATORS_DATA_DIR and the
+        # MIRRORED_VERSION pin in the fork's src/app/services/Versions.ts.
+        LATEST_VERSION: "1.21.1"
+    image: ulicraft/generators:local
+    container_name: generators
+    restart: unless-stopped
+    volumes:
+      # ~107M mcmeta + vanilla-mcdoc mirror from tooling/sync-generators-data.sh.
+      # Read-only: it is a fetched artifact, never something the app writes.
+      - ${GENERATORS_DATA_DIR:-./generators-data}:/srv/data:ro
+    networks:
+      - mcnet
+
   # Avatar/skin renderer — built from source (docker/nmsr/Dockerfile), pulls
   # player profiles from Drasl over mcnet. caddy proxies avatar. -> nmsr:8080.
   nmsr: