[Mimic890]

Stage 3: pages.

What

• Main page: top bar, newest posts (PAGE_SIZE per page, /?page=N; page 1 is /, out-of-range pages return 404) and an empty state.
• Post page: title, date, updated date, reading time (ceil(words / READING_WPM), at least 1 minute), cover and the sanitized post HTML. <html lang> comes from the post; the top bar keeps the UI language.
• Top bar: logo (assets/logo.svg from the vault, else a built-in mark), site name, theme toggle, EN/RU switch, RSS link and a GitHub link (if GITHUB_URL is set).
• Themes: light and dark, system theme by default. A theme cookie overrides it and is rendered on the server, with no inline JS. The chroma code palettes (github / github-dark) are scoped to the active theme.
• Languages: UI strings in internal/server/web/i18n/{en,ru}.json, including localized dates. A test checks that both files have the same keys.
• POST /prefs: a no-JS form. It checks the theme and lang values and sets the cookie (HttpOnly, SameSite=Lax, 1 year, Secure on https). It redirects only to a local path (open-redirect guard) and limits the body to 4 KB.
• /static/*: embedded CSS (content-hashed URL, immutable cache) and fonts. No directory listing.
• Fonts: Inter and JetBrains Mono from Fontsource 5.3.0 (npm integrity verified), Latin and Cyrillic subsets, OFL texts included. About 190 KB in total; browsers fetch only the subsets a page uses.
• HTML 404 and 503 pages. GET on POST-only paths still returns 405.
• SPEC + SPEC.ru: the two new endpoints in the endpoint table, plus a Decision log entry.

Tests

• Unit tests:
  • home pagination and its 404 cases;
  • frontmatter escaping in titles and descriptions;
  • cookie handling, including invalid values;
  • Russian rendering;
  • /prefs cookie attributes and the open-redirect cases;
  • static files and path traversal;
  • matching i18n keys.
• Smoke test with Garage, the service, and Caddy serving /assets/* from the mirror, plus headless Chrome:
  • screenshots in light and dark, English and Russian, at 1280 and 390 px;
  • real clicks on the theme and language buttons (303 back to the same URL, query kept);
  • fonts load, the vault logo and cover show, no horizontal scroll on mobile, no CSP violations.

Not done here

• The search box and "Popular" on the main page: stages 4 and 5.
• View count and votes on the post page: stage 5.
• Tags, RSS (the top-bar link returns 404 until stage 4), meta tags, OG tags, image size attributes and loading=lazy: stage 4.