feat(web): add the zycode product site on zycode.dev - #50

web/ holds a static Astro site for zycode. Cloudflare Workers serves it as static
assets, so no server of ours is necessary. The site is not a Python package: Ruff and
pytest do not read it.

- Languages: English at / and Chinese at /zh/. The type Messages in src/i18n/types.ts
  gives en.ts and zh.ts the same keys.
- Content: why, the event contract, architecture, features, install, status, and
  evidence. The status table equals the table "Status" in README.md. The evidence
  section equals the benchmark report and keeps its limits. The terminal demo says that
  it is an illustration.
- Header: links to GitHub and to PyPI (pi-agent-cli-lc), a theme toggle, and a language
  link. On a phone the two link buttons show only an icon, and each keeps its name for
  screen readers.
- Address: wrangler.jsonc binds the Custom Domain zycode.dev to the Worker, and closes
  the workers.dev and preview addresses. The default site address is
  https://zycode.dev. SITE_URL sets the address of a build.
- public/_headers: security headers (CSP, HSTS, nosniff, frame deny) and a long cache
  for /_astro/*. The CSP blocks the RUM beacon that Cloudflare adds to a Free zone.
- Preview hosts (workers.dev, pages.dev, localhost): robots.txt says Disallow: /, and
  each page has noindex.
- brand/: the avatar (an SVG source and a 1024 x 1024 PNG) and the header (a 1500 x 500
  PNG) of the X account of zycode. The header comes from the page /dev/x/header/, like
  the social card. That page exists only in `npm run dev`: getStaticPaths returns no
  path in a build.
- web/README.md: the commands, the deploy steps, the settings that live in Cloudflare
  and not in this repository (the www redirect, Always Use HTTPS, TLS 1.2 or later,
  0-RTT, DNSSEC, and a configuration rule that turns off the RUM beacon), the four
  no-mail DNS records (SPF -all, DMARC reject, an empty DKIM key, and a null MX), and
  the pictures for X. The README says that the DNS records must be replaced before the
  domain gets a mail service, because the DMARC policy reject makes a receiver reject
  a message that does not pass the checks.
- AGENTS.md: a row for web/ in the module map, and a row in the table of commands.

Checked:
- npm run check: 0 errors, 0 warnings (1 old hint in CopyButton.astro)
- npm run build: 3 pages, and dist/ has no dev/ folder
- 51 color pairs pass WCAG 2.2 AA (4.5:1 for text, 3:1 for large text and interface
  parts)
- live: 200 on /, /zh/, /robots.txt, /sitemap.xml and /og.png; 404 on an unknown path
  and on /dev/x/header/
- live: http://zycode.dev and https://www.zycode.dev answer 301 to https://zycode.dev
- live: 30 browser checks (terminal demo, tabs and keys, copy, theme, reveal, structure,
  Chinese page, endpoints, console) pass
- live: the page does not scroll sideways at 320, 390, 768, 1024 and 1440 px (English
  and Chinese)
- Ruff reads 0 files in web/ (ruff check . --show-files)