Make CLI success output copy-paste-safe; add --serve, docs hub, key hygiene

A successful clone printed a bare, timestamped app path that wrapped mid-word
in the terminal, so users' `cd` failed and `npm install && npm run dev` ran in
the wrong directory — a confusing failure from a successful clone. Plus there
was no first-party "see it locally" path, no central docs page, "clone" was
conflated with `git clone`, and key hygiene wasn't stated.

CLI (compiler):
- Add compiler/src/cliSummary.ts: a copy-paste-safe success block on stderr — a
  single QUOTED `cd "<app>" && npm install && npm run dev` line that survives
  terminal wrapping — plus the AGENTS.md safe-to-edit pointers (content.ts,
  components/). The machine-readable {"event":"done",...} JSON stays on stdout.
- Add --serve (npm install + npm run dev in the generated app) and --open
  (also open the browser at the detected dev URL). Wired into single + multi.
- Add writeLatestPointer(): refresh a runs/<site>/latest symlink to the newest
  run so there's a stable, timestamp-free cd/script target. The reuse/regen
  scanners already filter to digit-prefixed run dirs, so `latest` is ignored.
- Tests: cliSummary (quoting, single-line command, Next/Vite roots, stable-path
  preference, --serve/--open hint) and runsLayout (symlink write + in-place
  refresh, timestamp-free stable path).

Docs:
- Add docs/README.md as a central documentation index.
- State prominently that ditto "cloning" = generating a codebase from a live
  URL, NOT `git clone` (no source repo required), in README + docs hub.
- Add "keys are secrets: use $DITTO_API_KEY, never inline/commit, rotate
  anytime" beside the key/auth examples in README + docs/SERVICE.md.
- Document --serve/--open and the latest symlink in README + compiler/README.

Note: the live ditto.site/docs web route and the dashboard's inline-token
snippet live in the marketing-site repo and still need a change there.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CHANGELOG.md

@@ -6,6 +6,27 @@ so minor/patch semantics are not yet guaranteed.
 
 ## [Unreleased]
 
+### Changed — Local CLI success output and orientation
+
+- The `clone-static` CLI now prints a copy-paste-safe success summary to stderr: a
+  single **quoted** `cd "<app>" && npm install && npm run dev` line (survives terminal
+  wrapping — no more broken `cd` from a wrapped timestamped path) plus the key
+  `AGENTS.md` safe-to-edit pointers (`src/app/content.ts`, `src/app/components/`). The
+  machine-readable `{ "event": "done", ... }` JSON line on stdout is unchanged (now
+  also carrying `stableApp`).
+- Added `--serve` (run `npm install` + `npm run dev` in the generated app) and
+  `--open` (also launch the browser at the dev URL) so "see it locally" is one flag.
+- In the default runs layout, each clone now refreshes a `runs/<site>/latest` symlink
+  pointing at the newest run, giving a stable, timestamp-free path for `cd` and scripts.
+
+### Added — Docs hub and terminology/secret-hygiene clarifications
+
+- Added [`docs/README.md`](docs/README.md) as a central documentation index.
+- Clarified prominently that ditto.site "cloning" means generating a codebase from a
+  live URL, **not** `git clone` (no source repo required), in the README and docs hub.
+- Added an explicit "API keys are secrets — use `$DITTO_API_KEY`, never inline/commit,
+  rotate anytime" note beside the key/auth examples in the README and `docs/SERVICE.md`.
+
 ### Added — `ditto` unpack CLI
 
 - **`packages/cli`** — a zero-dependency `ditto` command-line helper. `ditto unpack