Run SHA-256 as WebAssembly with JS fallback; note ffmpeg.wasm as deferred

scripts/build-sha256-wasm.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Rebuild frontend/sha256-wasm.js (the base64-embedded WebAssembly SHA-256 block
+# function) from frontend/wasm/sha256.c. Needs clang with wasm32 + wasm-ld.
+set -euo pipefail
+cd "$(dirname "$0")/.."
+tmp=$(mktemp -d); trap 'rm -rf "$tmp"' EXIT
+clang --target=wasm32 -O3 -nostdlib -fno-builtin -ffreestanding \
+  -Wl,--no-entry -Wl,--export=compress -Wl,--import-memory -Wl,--initial-memory=65536 -Wl,--max-memory=1114112 \
+  -Wl,-z,stack-size=4096 -Wl,--strip-all \
+  frontend/wasm/sha256.c -o "$tmp/sha256.wasm"
+b64=$(base64 -w0 "$tmp/sha256.wasm")
+cat > frontend/sha256-wasm.js <<JS
+/* GENERATED by scripts/build-sha256-wasm.sh from frontend/wasm/sha256.c — do not edit.
+ * WebAssembly SHA-256 block compression, embedded as base64 so it loads with the
+ * page / worker that already loads sha256.js (no extra request, no MIME or SW change). */
+(function (root) {
+  root.SHA256_WASM_B64 = '$b64';
+  if (typeof module !== 'undefined' && module.exports) module.exports = root.SHA256_WASM_B64;
+})(typeof globalThis !== 'undefined' ? globalThis : this);
+JS
+echo "wasm: $(wc -c < "$tmp/sha256.wasm") bytes"