Add a one-page website at askkey.sudohg.com #160

Goal

Publish a one-page bilingual website for Ask Key at askkey.sudohg.com, built and deployed from this repository.

Context

• README.md, README.zh-CN.md, SECURITY.md: source for all claims on the page. The site must not claim more than these documents.
• assets/AppIcon.icon, assets/readme/: current visual assets.
• The page is a landing page, not a second documentation set. Install, upgrade and security details link back to the repository.

Scope

May change:

• site/ (new): static HTML/CSS, images, video, self-hosted fonts with their licenses.
• site-src/ (new): readable source and pinned build tooling for bundled site scripts (not deployed).
• .github/workflows/pages.yml (new): deploy site/ to GitHub Pages on pushes to main that touch site/.
• scripts/check_hygiene.py: add the Chinese page to CJK_ALLOWLIST.
• README.md, README.zh-CN.md, docs/README.md: link to the website.

Must not change: Sources/, Tests/ (except hygiene tests if the allowlist change requires it), ci.yml, product identifiers.

Rules for the page:

• No third-party requests at runtime: no CDN, no web fonts from external hosts, no analytics, no trackers.
• No build step for the pages themselves. The "How it works" film is the one exception: it bundles three.js (MIT, approved by the maintainer for this issue) with esbuild from site-src/how/ into site/how/how.js, and ships three.js's license text next to the bundle.
• English at /, Simplified Chinese at /zh/, linked to each other.
• Downloads link to https://github.com/sudoHG/AskKey/releases/latest; no version numbers hard-coded.
• The page states the limits listed under "What AskKey does not guarantee" in the README, and that there is no backup or recovery yet.
• Fonts: self-hosted OFL fonts are approved for this issue; commit each font's license next to it.

Steps

1. Build site/ with the hero, flow, permissions, supported clients, limits and download sections.
2. Add the Pages workflow with actions pinned to commit SHAs, as in ci.yml.
3. Record a short real approval-flow demo on the maintainer's Mac, with the maintainer present and synthetic credentials only, and replace the placeholder hero media.
4. Maintainer: enable GitHub Pages (source: GitHub Actions), set the custom domain, and add a DNS-only CNAME askkey -> sudohg.github.io record in Cloudflare.

Acceptance

• python3 scripts/check_hygiene.py passes.
• grep -rEn "https?://" site/ | grep -vE "github.com/sudoHG|askkey.sudohg.com|www.w3.org" prints only links (href), never src, @import or url() to external hosts.
• Both pages render without horizontal scrolling at 375, 768, 1280 and 1920 px wide, checked in a headless browser.
• After step 4, https://askkey.sudohg.com serves the page over HTTPS and /zh/ serves the Chinese page.

Blocked by

None.