Complete accessibility, performance, analytics, and security QA

[ashryanbeats]

Summary

• completes the roadmap's final accessibility and responsive audit across English and Japanese
• replaces React-hydrated timestamps and page transitions with small Astro scripts
• serves the hero through responsive AVIF/WebP sources and adds real upcoming Event JSON-LD
• adds stable Google Tag Manager events for RSVP, language, calendar, community, Discord, and feed-submission actions
• validates remote feed and Meetup URLs, safely serializes JSON-LD, and generates hash-based Cloudflare CSP/security headers
• publishes /.well-known/security.txt using the existing community contact channel
• reconciles all six findings in the 2026-07-10 Cloudflare Security Insights export, including exact DNS actions and verification steps
• removes the public design draft and unused starter assets
• documents the analytics contract and security review

Verification

• npm run check
• production build, including generated security.txt comparison
• 117 unit tests across 15 files
• axe WCAG A/AA: no violations at 1200px, 768px, 390px, or 320px across both locales
• no horizontal overflow at the audited widths
• core Japanese RSVP path verified with JavaScript disabled
• every documented analytics event verified to push exactly once
• npm audit: zero known vulnerabilities
• Lighthouse production preview: Performance 100, Accessibility 100, Best Practices 100, SEO 100; LCP 1.7s, CLS 0, TBT 30ms

Cloudflare account follow-up

The repository-owned Security Insights finding is fixed here. The remaining required account-level actions are documented in docs/security-best-practices-report.md:

1. Remove or repair the dangling *.kyototechmeetup.com A record.
2. Add Hover's SPF record at the apex: v=spf1 include:_spf.hostedemail.com ~all.
3. Add an initial DMARC monitoring record at _dmarc: v=DMARC1; p=none;.

The AI bot and AI Labyrinth insights are optional policy choices, not application vulnerabilities. The recommendation is to keep Search discovery available, decide Agent access separately, and block Training if the community does not want published content used for model training.

After merge, verify the generated security headers and /.well-known/security.txt on production.

[cloudflare-workers-and-pages]

Deploying kyoto-tech-github-io with    Cloudflare Pages

Latest commit:	61ef370
Status:	✅  Deploy successful!
Preview URL:	https://7543eb92.kyoto-tech-github-io.pages.dev
Branch Preview URL:	https://dev-final-qa.kyoto-tech-github-io.pages.dev

View logs