Make CLI success output copy-paste-safe; add --serve, docs hub, key hygiene

A successful clone printed a bare, timestamped app path that wrapped mid-word
in the terminal, so users' `cd` failed and `npm install && npm run dev` ran in
the wrong directory — a confusing failure from a successful clone. Plus there
was no first-party "see it locally" path, no central docs page, "clone" was
conflated with `git clone`, and key hygiene wasn't stated.

CLI (compiler):
- Add compiler/src/cliSummary.ts: a copy-paste-safe success block on stderr — a
  single QUOTED `cd "<app>" && npm install && npm run dev` line that survives
  terminal wrapping — plus the AGENTS.md safe-to-edit pointers (content.ts,
  components/). The machine-readable {"event":"done",...} JSON stays on stdout.
- Add --serve (npm install + npm run dev in the generated app) and --open
  (also open the browser at the detected dev URL). Wired into single + multi.
- Add writeLatestPointer(): refresh a runs/<site>/latest symlink to the newest
  run so there's a stable, timestamp-free cd/script target. The reuse/regen
  scanners already filter to digit-prefixed run dirs, so `latest` is ignored.
- Tests: cliSummary (quoting, single-line command, Next/Vite roots, stable-path
  preference, --serve/--open hint) and runsLayout (symlink write + in-place
  refresh, timestamp-free stable path).

Docs:
- Add docs/README.md as a central documentation index.
- State prominently that ditto "cloning" = generating a codebase from a live
  URL, NOT `git clone` (no source repo required), in README + docs hub.
- Add "keys are secrets: use $DITTO_API_KEY, never inline/commit, rotate
  anytime" beside the key/auth examples in README + docs/SERVICE.md.
- Document --serve/--open and the latest symlink in README + compiler/README.

Note: the live ditto.site/docs web route and the dashboard's inline-token
snippet live in the marketing-site repo and still need a change there.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/README.md

@@ -0,0 +1,57 @@
+# ditto.site Documentation
+
+The central index for ditto.site's docs. Start here.
+
+> **First, the word "clone."** In ditto.site, *cloning* means **generating a
+> codebase from a live URL** — it is **not** `git clone`. You do **not** need an
+> existing Git repository, and you do **not** need the target site's source code.
+> You give ditto.site a public URL; it captures what the page renders in a browser
+> and writes you a fresh, runnable project. (The only `git clone` involved is
+> optionally cloning *this tool's* repository to run the compiler locally.)
+
+## Get started
+
+| I want to… | Go to |
+| --- | --- |
+| Understand what ditto.site is and see it run | [Project README](../README.md) |
+| Call the hosted **REST API** or **MCP** server | [Project README → Usage](../README.md#usage), [SERVICE.md](SERVICE.md) |
+| Turn a clone result JSON into files on disk | [`ditto unpack` CLI](../packages/cli/README.md) |
+| Run the **compiler locally** from the command line | [compiler/README.md](../compiler/README.md) |
+| Deploy the service | [DEPLOY.md](DEPLOY.md) |
+| Read the development & evaluation method | [METHODOLOGY.md](METHODOLOGY.md) |
+| Understand responsible-use boundaries | [RESPONSIBLE_USE.md](RESPONSIBLE_USE.md) |
+| Cut a release | [RELEASING.md](RELEASING.md) |
+
+## API keys are secrets
+
+Keys look like `dtto_live_...`. Keep them in an environment variable and reference
+it in commands:
+
+```bash
+export DITTO_API_KEY="dtto_live_..."
+curl -sS -H "authorization: Bearer $DITTO_API_KEY" "$DITTO_API_URL/v1/clones"
+```
+
+Never paste a raw key inline (it leaks into shell history, logs, and chat), and
+never commit one. Rotate a leaked key anytime from the dashboard. See
+[SERVICE.md](SERVICE.md) for the full auth model.
+
+## The short version of the workflow
+
+1. **Clone** a URL → `POST /v1/clones` (API) or `npm run clone -- <url>` (local CLI).
+2. **Get the app** → unpack the result JSON with [`ditto unpack`](../packages/cli/README.md),
+   download the `bundle?format=tgz` archive, or read files from `runs/<site>/latest/`.
+3. **Preview it** → `cd` into the app and `npm install && npm run dev` (or let the
+   local CLI do it for you with `--serve` / `--open`).
+4. **Edit safely** → each generated app ships an `AGENTS.md` describing what's safe
+   to change (copy in `src/app/content.ts`, components in `src/app/components/`, etc.).
+
+## Full doc list
+
+- [SERVICE.md](SERVICE.md) — REST + MCP service reference (endpoints, options, env vars).
+- [DEPLOY.md](DEPLOY.md) — production deployment.
+- [METHODOLOGY.md](METHODOLOGY.md) — how the compiler is developed and evaluated.
+- [RESPONSIBLE_USE.md](RESPONSIBLE_USE.md) — acceptable-use boundaries.
+- [RELEASING.md](RELEASING.md) — release process.
+- [../compiler/README.md](../compiler/README.md) — local compiler commands.
+- [../packages/cli/README.md](../packages/cli/README.md) — the `ditto unpack` CLI.

docs/SERVICE.md

@@ -89,6 +89,11 @@ GET    /healthz                    → { ok: true }  (unauthenticated)
 
 `/v1/clones*` and `/mcp` are authenticated when `API_KEYS` is set or DB-backed
 keys exist. Use `Authorization: Bearer <key>` or `x-api-key: <key>`.
+
+> **Treat keys as secrets.** In any snippet you copy or share, template the key as
+> an environment variable (`Authorization: Bearer $DITTO_API_KEY`) rather than an
+> inline `dtto_live_...` token — inline keys leak into shell history, logs, and
+> pasted transcripts. Never commit a key; rotate a leaked one from the dashboard.
 Signup routes are intentionally public only when `SIGNUP_ENABLED=true` **and**
 `DATABASE_URL` is set. Direct `POST /v1/signup` mints a `dtto_live_...` key
 immediately when `SIGNUP_DIRECT_ENABLED=true`. For public production signup,