sx-pub: plan page, dev infrastructure, JS bundle rebuild

- Add sx-pub plan page under Applications with full protocol spec:
  wire format, endpoints, storage, flows, AP critique, phases
- Add nav entry and page function for /sx/(applications.(sx-pub))
- Add docker-compose.dev-pub.yml (sx_docs image + DB + IPFS + Redis)
- Add dev-pub.sh launch script (pub.sx-web.org via Caddy)
- Rebuild sx-browser.js with var fixes for SES compatibility

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.dev-pub.yml

@@ -0,0 +1,112 @@
+# Dev mode for sx-pub (SX-based ActivityPub)
+# Starts as sx_docs clone — AP protocol built in SX from scratch
+# Accessible at pub.sx-web.org via Caddy on externalnet
+# Own DB + pgbouncer + IPFS node
+
+services:
+  sx_pub:
+    image: registry.rose-ash.com:5000/sx_docs:latest
+    environment:
+      SX_STANDALONE: "true"
+      SECRET_KEY: "${SECRET_KEY:-pub-dev-secret}"
+      REDIS_URL: redis://redis:6379/0
+      DATABASE_URL: postgresql+asyncpg://postgres:change-me@pgbouncer:5432/sx_pub
+      WORKERS: "1"
+      ENVIRONMENT: development
+      RELOAD: "true"
+      SX_USE_REF: "1"
+      SX_USE_OCAML: "1"
+      SX_OCAML_BIN: "/app/bin/sx_server"
+      SX_BOUNDARY_STRICT: "1"
+      SX_DEV: "1"
+      OCAMLRUNPARAM: "b"
+      IPFS_API: http://ipfs:5001
+    ports:
+      - "8014:8000"
+    volumes:
+      - /root/sx-pub/_config/dev-sh-config.yaml:/app/config/app-config.yaml:ro
+      - ./shared:/app/shared
+      - ./sx/app.py:/app/app.py
+      - ./sx/sxc:/app/sxc
+      - ./sx/bp:/app/bp
+      - ./sx/services:/app/services
+      - ./sx/content:/app/content
+      - ./sx/sx:/app/sx
+      - ./sx/path_setup.py:/app/path_setup.py
+      - ./sx/entrypoint.sh:/usr/local/bin/entrypoint.sh
+      - ./sx/__init__.py:/app/__init__.py:ro
+      # Spec + web SX files
+      - ./spec:/app/spec:ro
+      - ./web:/app/web:ro
+      # OCaml SX kernel binary
+      - ./hosts/ocaml/_build/default/bin/sx_server.exe:/app/bin/sx_server:ro
+      # sibling models for cross-domain SQLAlchemy imports
+      - ./blog/__init__.py:/app/blog/__init__.py:ro
+      - ./blog/models:/app/blog/models:ro
+      - ./market/__init__.py:/app/market/__init__.py:ro
+      - ./market/models:/app/market/models:ro
+      - ./cart/__init__.py:/app/cart/__init__.py:ro
+      - ./cart/models:/app/cart/models:ro
+      - ./events/__init__.py:/app/events/__init__.py:ro
+      - ./events/models:/app/events/models:ro
+      - ./federation/__init__.py:/app/federation/__init__.py:ro
+      - ./federation/models:/app/federation/models:ro
+      - ./account/__init__.py:/app/account/__init__.py:ro
+      - ./account/models:/app/account/models:ro
+      - ./relations/__init__.py:/app/relations/__init__.py:ro
+      - ./relations/models:/app/relations/models:ro
+      - ./likes/__init__.py:/app/likes/__init__.py:ro
+      - ./likes/models:/app/likes/models:ro
+      - ./orders/__init__.py:/app/orders/__init__.py:ro
+      - ./orders/models:/app/orders/models:ro
+    depends_on:
+      - pgbouncer
+      - redis
+      - ipfs
+    networks:
+      - externalnet
+      - default
+    restart: unless-stopped
+
+  db:
+    image: postgres:16
+    environment:
+      POSTGRES_USER: postgres
+      POSTGRES_PASSWORD: change-me
+      POSTGRES_DB: sx_pub
+    volumes:
+      - db_data:/var/lib/postgresql/data
+    restart: unless-stopped
+
+  pgbouncer:
+    image: edoburu/pgbouncer:latest
+    environment:
+      DB_HOST: db
+      DB_PORT: "5432"
+      DB_USER: postgres
+      DB_PASSWORD: change-me
+      POOL_MODE: transaction
+      DEFAULT_POOL_SIZE: "10"
+      MAX_CLIENT_CONN: "100"
+      AUTH_TYPE: plain
+    depends_on:
+      - db
+    restart: unless-stopped
+
+  ipfs:
+    image: ipfs/kubo:latest
+    volumes:
+      - ipfs_data:/data/ipfs
+    restart: unless-stopped
+
+  redis:
+    image: redis:7-alpine
+    restart: unless-stopped
+
+volumes:
+  db_data:
+  ipfs_data:
+
+networks:
+  externalnet:
+    external: true