fix(docker): serve x2t WASM as gzip on plain HTTP

[chaxus]

Merge Verdict

[APPROVE] — The Docker transport fix reproduces and resolves the ordinary-HTTP WASM decoding failure without changing the decoded module.

Summary

Chrome refuses Brotli decoding on ordinary HTTP origins outside localhost. Docker was unconditionally serving Content-Encoding: br, so http://<server-ip> failed with ERR_CONTENT_DECODING_FAILED and x2t WASM instantiation failed: TypeError: Failed to fetch.

• Re-encode only the Docker builder's WASM copy as gzip and serve the matching header. Run before the production build fingerprints the vendor tree.
• Keep the loader URL, streaming loader, and HTTPS Pages Brotli payload. Update the deployment contract, changelog, and coverage ledger.
• Add real-vendor byte-equivalence checks and a browser test on an explicitly insecure HTTP origin; localhost previously concealed this defect.

Closes #267.

Risk Analysis

Low risk: decoded WASM bytes are identical. Docker's WASM transfer grows from 6,898,179 to 10,058,136 bytes; HTTPS Pages retains the smaller Brotli payload.

Design Decisions

• Preserve the existing opaque .br URL; Content-Encoding describes the actual transport representation.
• Re-encode before Vite copies public assets and the service worker's vendor fingerprint is computed.
• Test isSecureContext === false using a Chromium hostname mapping to the container, rather than substituting loopback HTTP.

Code Concerns

No actionable findings after tracing both converter loaders, native response decoding, the service-worker cache URL, and build ordering.

Verification

• Full unit suite: 5,413 passed across 184 files.
• Final focused loader/hosting/packaging suite: 58 passed across 5 files, with a single worker to avoid contention. Existing asynchronous-rejection warnings remain; there were no failed assertions.
• pnpm run lint:ts: passed; final changed code also passed oxlint --deny-warnings.
• pnpm run format:check: passed; git diff --check: passed.
• Browser regression against static-web-server 2.42.0: failed before the fix with TypeError: Failed to fetch, then passed with gzip on a non-trustworthy HTTP origin and compiled the real WASM.
• The local full Docker build was stopped after unusually slow base-layer processing; complete image/container validation is pending repository Docker CI, which runs the added regression. No image publication or deployment is included in this PR.

Conclusion basis: Verified by the commands and browser reproduction above; full-container validation remains pending at PR creation.

[cloudflare-workers-and-pages]

Deploying document with    Cloudflare Pages

Latest commit:	e9fd8f5
Status:	✅  Deploy successful!
Preview URL:	https://38d4bda1.document-7hm.pages.dev
Branch Preview URL:	https://fix-docker-http-wasm.document-7hm.pages.dev

View logs