HTTP surfaces

# HTTP surfaces

One PHP application serves three named surfaces.

## Surfaces

- **Web** — public HTML pages (`/`, `/docs/` after a `308` from `/docs`,
  `/samples`, `/showcase`).
- **Admin** — HTML behind `/admin` after authentication.
- **API v1** — JSON under `/api/v1`. Success uses `{"data": ...}`. Errors
  use RFC 9457 problem details (`application/problem+json`). Curated
  diagram models use `GET /api/v1/docs/diagrams/{id}` (literal id
  allowlist). A valid `g5nx-diagram` fence lazy-loads a first-party
  renderer inside the Markdown document island.

## Route names

Route names carry a surface prefix: `web.`, `admin.`, or `api.v1.`.

## JavaScript islands

Pages may attach a logical `islands` asset. Mount points expose only
escaped scalar `data-*` attributes. There is no JSON blob in markup.

```js
const sourceUrl = mountPoint.getAttribute('data-source-url');
const title = mountPoint.getAttribute('data-title');
```

Without JavaScript the escaped Markdown fallback remains visible.