Two product names: ParaSend and ParaSign, and the rules page moves to /rules

[Apolloccrypt]

Snoeiplan point 4: five product names become two. ParaSend and ParaSign stay.
ParaShare and ParaRules were never products, and this takes them out of the copy
without breaking a single URL that a visitor, a search engine or an installed
extension already holds.

Built from the inventory in Bevinding - ParaShare en ParaRules, waar ze nog zitten
(measured on b38196b), option (b) for ParaShare and the standalone ParaRules half.

1. ParaShare: the name goes, the URL stays

/parashare cannot move and is not touched:

• extensions/shared/paramant-core.js bakes https://paramant.app/parashare
  into every link the Chromium and Thunderbird extensions ever minted. Those
  links sit in recipients' mailboxes with the key in the fragment, and an
  installed extension is not updated retroactively.
• relay/relay.js answers the retired /v2/anon-inbound with
  Link: <https://paramant.app/parashare>; rel="successor-version", which is in
  the sdk-js 3.x contract until the Sunset on 31-12-2026.

So no code identifier, no test on a URL, no extension and no nginx gate is
touched. What changes is what a buyer reads: the page is "the ParaSend web app"
or "the sending tool".

Two deliberate exceptions:

• The three legal documents keep ParaShare as a defined contract term,
  glossed once each as "ParaShare (the ParaSend web app)". Dropping a defined
  term out of live conditions is not a search and replace, so the same service
  stays covered and the reader is told what it is.
• The register row <td>ParaShare (webapp)</td> on /crypto-agility keeps
  its label. It is a technical key, not a product name: tests/ui-truthfulness.test.mjs
  and relay/test/pricing-page.test.js both read the algorithms out of that row
  by that string, and the snoeiplan wants more of those gates, not fewer.

2. ParaRules: "Our rules" on /rules

frontend/pararules.html becomes frontend/rules.html, the H1 becomes
"Our rules", and the nine rules with their verify links from #328 move across
word for word. "ParaRule 5" becomes "rule 5" on /parasend and /parasign.
The sitemap is regenerated by bron-seo/build_sitemap.py.

/pararules is indexed, so it keeps a permanent 301 in both repo confs, and
phase 5c of the 3.1 runbook gains a fourth nginx edit that writes it on the
server:

location = /pararules { return 301 https://$host/rules; }

The edit is anchored on the ParaID deny rather than on the hostname, because
deploy/nginx-paramant-live.conf carries no server_name at all (it is the
backend paramant-public.conf proxies to), so a hostname anchor would have
landed the redirect in one conf and not the other. It is two-pass like the
/v2/outbound buffer edit next to it: pass one learns which blocks already
carry the line, pass two inserts only into the ones that do not, so it lands in
every site block and a second deploy rewrites nothing. deploy/DEPLOY-3.1.md
now documents step 5c as four edits, with the line to add if you are doing it
by hand.

3. Pins, each one sabotaged before it was believed

pin	sabotage	caught by
no public page carries ParaShare in an H1, a card heading or a kicker	product card renamed back on /press	ui-truthfulness: "these pages present ParaShare in copy again: press.html"
same, for the kicker this round fixed	eyebrow on /parashare back to PARASHARE	ui-truthfulness: "a heading, card or kicker presents a retired name as a product"
the legal term is glossed where it is used	gloss dropped from /terms	ui-truthfulness: "uses ParaShare as a contract term without ever defining it"
both repo confs carry the 301	redirect deleted from paramant-public.conf	ui-truthfulness: "has no 301 from /pararules to /rules"
nothing links to the old path	homepage link back to /pararules	ui-truthfulness and links
the new title and description of /rules	title reverted to "ParaRules"	seo-contract PINNED table
the nine rules keep a verify link each	one rule-verify renamed	ui-truthfulness: "9 rules but 8 verify links"
the deploy writes the fourth edit	the insert line deleted from deploy-3.1.sh	deploy-3.1-dryrun: "the 301 landed in 0 of 2 site blocks"

Tests

Green: ui-truthfulness, seo-contract, links, site-claims, first-screen,
navigation-shell, user-dashboard-documents, pricing-fold,
product-heartbeat, frontend-module-scripts, frontend-loading-contract,
code-manifest, access-log-visitors, usage-purpose, receive-filename,
vault-filename, version-consistency, env-documented,
relay/test/pricing-page.test.js (47 checks), tests/deploy-3.1-dryrun.test.sh
(200 checks, including the new 5c assertions), tests/static-sanity.sh (eleven
checks), scripts/check-csp-inline.sh, scripts/check-cache-bust.sh, eslint,
bron-seo/apply_seo_head.py --check, bron-seo/build_sitemap.py --check.

Not run: tests/heartbeat-lib.test.mjs, which cannot resolve
@noble/post-quantum in this environment. That is missing on main as well and
has nothing to do with this change.

Count per file

file	lines
README.md	+3 / -3
deploy/DEPLOY-3.1.md	+30 / -11
deploy/deploy-3.1.sh	+70 / -5
deploy/nginx-paramant-live.conf	+4 / -0
deploy/nginx-paramant-public.conf	+5 / -0
docs/brand/messaging.md	+17 / -10
docs/site-claims.md	+1 / -1
frontend/architecture.html	+4 / -4
frontend/audit-log-export.html	+1 / -1
frontend/docs.html	+3 / -3
frontend/dpa.html	+1 / -1
frontend/index.html	+2 / -2
frontend/parasend.html	+7 / -7
frontend/parashare.html	+2 / -2
frontend/parasign.html	+1 / -1
frontend/press.html	+1 / -1
frontend/pricing.html	+2 / -2
frontend/privacy.html	+1 / -1
frontend/pararules.html -> frontend/rules.html	+9 / -9
frontend/security.html	+6 / -6
frontend/sitemap.xml	+21 / -21 (regenerated)
frontend/terms.html	+1 / -1
tests/deploy-3.1-dryrun.test.sh	+26 / -0
tests/seo-contract.test.mjs	+9 / -0
tests/ui-truthfulness.test.mjs	+143 / -12

27 lines of ParaShare copy and 29 ParaRules touch points, which is what the
inventory priced option (b) plus the standalone ParaRules half at.

Not merged

Opened for review only. The nginx side needs step 5c of the 3.1 runbook to run
before /pararules answers a 301 in production; until then the repo confs and
the deploy script carry it and the page is served from /rules.