Unify the control styling, add racer sprites, fill the store, reserve ad space

Design tokens
- The stylesheet had five corner radii in use with no rule for which applied
  where, so a button was square while the input beside it was rounded and the
  icon button next to that was something else again. Two tokens now: --radius
  for controls, --radius-panel for the surfaces they sit on.
- One border weight. Buttons were 2px and inputs 1px, which made a field and
  its own button read as different weights of the same idea. The two start
  buttons keep 2px, where it is doing work.
- Letter-spacing was 1px, 2px, 3px and 4px with no rule behind it. Now 1px
  for small caps labels and 2px for button text.
- Removed the .ghost modifier. After the hierarchy pass it rendered
  identically to .quiet, so the two were one control under two names. Its
  uses were toggles, which .quiet plus .active already expresses.

Racer sprites
- Six sprites in the same angular language as the rest of the icon set, one
  per racer in the lobby and the race. A race reads as characters moving
  rather than as coloured lines with names attached. Assigned from the
  server's player order, so every client draws the same person as the same
  character without needing to agree on anything.

Store
- Six items to twenty-six, across three slots. Race sprites join carets and
  flair as a third slot, with the equipped sprite stored per user. Nothing is
  required to race: an unequipped player keeps the sprite their position in
  the room assigns.

Advertising space
- Reserved, empty, and loading nothing. The slot exists so that adding a
  network later cannot push the page around when the tag loads. Shown to
  signed-out visitors and to accounts without the supporter flag, on the end
  screen only: interrupting somebody mid-test is the one placement that would
  cost more than it earns.
- No ad code is included, and none can be added without three deliberate
  changes recorded in adSlot.js: the CSP forbids third-party script, frame
  and image sources; the privacy page states there is no advertising and no
  third-party script; and an ad network brings consent requirements that this
  app has no mechanism for. Verified after this change that the only external
  request the page makes is still fonts.googleapis.com.

1 files changed, 60 insertions, 0 deletions

diff --git a/web/src/adSlot.js b/web/src/adSlot.js
new file mode 100644
index 0000000..4b8ce2e
--- /dev/null
+++ b/web/src/adSlot.js
@@ -0,0 +1,60 @@
+import { getUser, onAuthChange } from './auth.js';
+
+// Reserved space for advertising.
+//
+// This renders an empty, correctly sized box. It loads nothing, calls
+// nothing, and tracks nobody. Its only job is to hold the space so that
+// wiring a real network later does not move the rest of the page around
+// after it loads, which is the usual way ads ruin a layout.
+//
+// Before any network goes in, three things have to change together:
+//
+//   1. The Content-Security-Policy in web/serve.mjs forbids third-party
+//      script, frame and image sources. An ad network needs all three, and
+//      relaxing them is the single largest change to this app's security
+//      posture. script-src in particular currently has no third-party source
+//      at all.
+//   2. The privacy page in app.js says there is no advertising and no
+//      third-party script. That becomes untrue the moment a tag is added.
+//   3. An ad network sets cookies and profiles visitors, which brings
+//      consent requirements with it. There is no consent mechanism here.
+//
+// Shown to signed-out visitors and to signed-in accounts without the
+// supporter flag. Never shown on the typing screen: interrupting somebody
+// mid-test is the one placement that would cost more than it earns.
+
+const SIZES = {
+    // Roughly a leaderboard unit, and a mobile banner below the breakpoint.
+    banner: { w: 728, h: 90, mobileW: 320, mobileH: 100 },
+};
+
+export function shouldShowAds() {
+    const user = getUser();
+    // A signed-out visitor is a free user for this purpose.
+    return !user || !user.is_supporter;
+}
+
+/// Renders the slot into `root`. Returns a cleanup function.
+export function renderAdSlot(root, { size = 'banner', label = 'Advertisement' } = {}) {
+    const spec = SIZES[size] || SIZES.banner;
+    const wrap = document.createElement('div');
+    wrap.className = `ad-slot ad-slot-${size}`;
+    wrap.style.setProperty('--ad-w', `${spec.w}px`);
+    wrap.style.setProperty('--ad-h', `${spec.h}px`);
+    wrap.style.setProperty('--ad-mobile-w', `${spec.mobileW}px`);
+    wrap.style.setProperty('--ad-mobile-h', `${spec.mobileH}px`);
+    // Labelled for what it is. An unlabelled empty box reads as a bug.
+    wrap.innerHTML = `<span class="ad-slot-label">${label}</span>`;
+
+    function paint() {
+        wrap.hidden = !shouldShowAds();
+    }
+    paint();
+    const unsubscribe = onAuthChange(paint);
+
+    root.appendChild(wrap);
+    return () => {
+        unsubscribe();
+        wrap.remove();
+    };
+}