v0.1.0-alpha: interactive demo platform core

- Fastify API: demos/steps CRUD, content-addressed assets, scoped API keys
  (read/author/publish/admin, draft-only default per D4)
- Player: image + sandboxed DOM steps, hotspots, tooltips, keyboard nav,
  privacy-first beacons (no IP storage, viewer tokens only — R7)
- Editor: React SPA — demo list, drag-to-draw hotspots, annotations, publish
- MCP server: Streamable HTTP, scope-filtered tools, untrusted-data wrapping
  on viewer-supplied content (R8); platform never calls a model
- Capture extension (MV3): screenshot-flow recording, hotspots pre-placed
  from real clicks
- Docker: single app image + postgres, Traefik-ready (expose only)

E2E verified: capture->author->publish->play->beacon->lead->analytics + full
MCP tool surface with scope filtering.

extension/content.js

@@ -0,0 +1,16 @@
+// Reports click positions as viewport percentages. Injected only while recording.
+(function () {
+  if (window.__dpCaptureInstalled) return;
+  window.__dpCaptureInstalled = true;
+  document.addEventListener(
+    "click",
+    (e) => {
+      chrome.runtime.sendMessage({
+        type: "click",
+        xPct: (e.clientX / window.innerWidth) * 100,
+        yPct: (e.clientY / window.innerHeight) * 100,
+      });
+    },
+    true,
+  );
+})();