chore(deps): bump the minor-and-patch group across 1 directory with 3 updates

.github/workflows/deploy.yml

@@ -12,9 +12,6 @@ concurrency:
   group: pages-${{ github.ref_name }}
   cancel-in-progress: false
 
-env:
-  SITE_AUTH_PASSWORDS: ${{ secrets.SITE_AUTH_PASSWORDS }}
-
 jobs:
   deploy:
     runs-on: ubuntu-latest
@@ -44,24 +41,11 @@ jobs:
             echo "target-folder=dev" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Compute auth hashes
-        if: ${{ env.SITE_AUTH_PASSWORDS != '' }}
-        run: |
-          HASHES=$(node -e "
-            const crypto = require('crypto');
-            const raw = process.env.SITE_AUTH_PASSWORDS;
-            const hashes = raw.split('\n').map(p => p.trim()).filter(Boolean)
-              .map(p => crypto.createHash('sha256').update(p).digest('hex'));
-            process.stdout.write(hashes.join(','));
-          ")
-          echo "SITE_AUTH_HASHES=$HASHES" >> $GITHUB_ENV
-
       - name: Build
         run: npm run build
         env:
           SITE_URL: ${{ steps.site.outputs.url }}
           SITE_BASE: ${{ steps.site.outputs.base }}
-          SITE_AUTH_HASHES: ${{ env.SITE_AUTH_HASHES }}
 
       - name: Pagefind
         run: npx pagefind --site dist
@@ -74,4 +58,3 @@ jobs:
           target-folder: ${{ steps.site.outputs.target-folder }}
           clean-exclude: |
             dev
-            pr-preview

CLAUDE.md

@@ -172,8 +172,7 @@ At ≤640px the `.nav-links` div is `display:none`; `nav.nav-open .nav-links { d
 - **ECharts** is only loaded on pages whose island renders a chart: `/compare` (`Compare` → `CurveChart`), `/explore` (`DesignSpace`), `/stack` (`StackBuilder` → `SystemResponse` → `CurveChart`), `/enclosures/[slug]` (`BoxCurves` → `CurveChart`), `/drivers/compare` and `/horns/compare` (`RadarCompare`). `/find` (`Explorer.svelte`) is list/filter only and does **not** pull in ECharts. All imports go through `src/lib/echarts.ts` to keep the bundle tree-shaken.
 - **`client:only="svelte"`** on all islands. No SSR for interactive components. Fetches use `BASE` from `src/lib/site.ts` (the canonical export — never re-derive from `import.meta.env` inline). i18n in islands via `getClientTranslations()` from `src/lib/locale-client.ts`.
 - **Routing**: all content pages live under `src/pages/[locale]/`; `src/pages/index.astro` redirects to the default locale. The locale segment is part of every internal link — use `localeBase` (SSR) or `BASE + /[locale]` (client) rather than root-absolute paths.
-- **Password gate**: `src/lib/auth.ts` exports `AUTH_ENABLED` (hardcoded `true`) and `AUTH_HASHES`, parsed from the `SITE_AUTH_HASHES` build-time env var. `Layout.astro` renders a full-screen password form when both are non-empty, hashes the entered password client-side (`crypto.subtle.digest("SHA-256")`) and compares hex digests, storing a pass flag in `sessionStorage`. Plaintext passwords never touch the repo: each deploy workflow (`deploy.yml` for `main`/`develop`, `pr-preview.yml` for PR previews) reads the same `SITE_AUTH_PASSWORDS` GitHub secret (comma-separated plaintext), hashes each to build `SITE_AUTH_HASHES`, and only sets it as a build env var, so production, the `/dev/` preview and every PR preview are gated identically. Set the secret to an empty string (or remove it) to ship ungated everywhere. Local dev: set `SITE_AUTH_HASHES` in `.env`, or leave unset for no gate.
-- **`SITE_BASE`**: `astro.config.mjs`'s `base` is `process.env.SITE_BASE || "/"`, not hardcoded. Pages deploys from the `gh-pages` branch (not the Actions-based Pages deployment), so `main`, `develop` and PR previews all coexist as subfolders of one branch, each workflow sets `SITE_BASE`/`SITE_URL` explicitly per environment (`/boxdex/`, `/boxdex/dev/`, `/boxdex/pr-preview/pr-<n>/`), there's no `configure-pages` auto-detection anymore.
+- **`SITE_BASE`**: `astro.config.mjs`'s `base` is `process.env.SITE_BASE || "/"`, not hardcoded. Pages deploys from the `gh-pages` branch (not the Actions-based Pages deployment), so `main` and `develop` coexist as subfolders of one branch, `deploy.yml` sets `SITE_BASE`/`SITE_URL` explicitly per environment (`/boxdex/`, `/boxdex/dev/`), there's no `configure-pages` auto-detection anymore.
 - **`data/enclosures/fk-*`**: synthetic fixture entries generated by `scripts/local/gen-fake-data.mjs` (local-only script, runs `gen-fk-a-i.mjs` / `gen-fk-j-k.mjs` / `gen-fk-l-o.mjs`) to stress-test catalog UI at scale. Not real products, don't "correct" their specs against datasheets, regenerate with `--force` instead of hand-editing.
 - All units **SI only**: mm, L, Hz, dB, kg, W, Ω. No imperial.
 

README.md

@@ -67,11 +67,6 @@ With [mise](https://mise.jdx.dev): `mise run dev|build|test|lint|check|fix|verif
 (`.github/workflows/deploy.yml`) builds and publishes `dist/` automatically on push to
 `main`.
 
-Optionally set the `SITE_AUTH_PASSWORDS` repo secret (comma-separated plaintext) to
-put the whole site behind a password gate: the workflow hashes each password at build
-time into `SITE_AUTH_HASHES`, no plaintext ever lands in the repo. Leave it unset for
-no gate.
-
 ## Contributing
 
 See [CONTRIBUTING.md](CONTRIBUTING.md) for the folder conventions, CSV format, and