document repo map and local dev, add deploy-prod skill

- CLAUDE.md gains a repo map, endpoint list, and local dev setup
  (server serves only ./public — symlink ../frontend once)
- new deploy-prod skill captures the Dokploy deploy + buildTag
  verification flow; track .agents/.claude skills and skills-lock.json
- ignore server/data, test-results, .claude/worktrees

CLAUDE.md

@@ -5,6 +5,39 @@ Ad-free YouTube player. Three shells share `frontend/`: **web PWA** (Bun + Hono
 `server/`, the production deployment), Tauri (Windows), zero-native (Linux/macOS).
 The PWA is what runs in production; `legacy/` holds the old native-only docs.
 
+## Repo map
+
+| Path | What lives there |
+|------|------------------|
+| `frontend/app.js` | The entire UI (~3.6k lines, no framework): player, playlists, search, settings, sync |
+| `frontend/sw.js` + `frontend/sw-update.js` | Service worker + update flow (FRAGILE — see below) |
+| `frontend/opfs.js` / `opfs-worker.js` | OPFS offline audio cache |
+| `frontend/fingerprint.js` | Browser fingerprint used as the sync key |
+| `frontend/async-guard.js` | Stale-async-response guard (unit-tested) |
+| `server/server.js` | Bun + Hono backend — endpoint list is in its header comment |
+| `server/db.js` | libsql schema/queries (`users`, `profiles`, `video_history`…) |
+| `bin/yt-dlp` | Downloaded by `npm run setup`, gitignored |
+| `scripts/` | icon generation, yt-dlp setup, push helper |
+| `tests/` | Playwright e2e specs · unit tests live next to sources in `frontend/*.test.js` |
+| `legacy/` | Old native-shell docs — do not treat as current |
+
+API endpoints: `GET /api/search|channel|streams|download/:id|version|user/data|profile/load`,
+`POST /api/user/sync|profile/create|profile/save`, `GET /sw.js` (BUILD_TAG-injected), `GET /*` static.
+JSON shapes mirror the Tauri Rust bridge exactly — don't change one side alone.
+
+## Local dev
+
+```bash
+npm run setup            # download bin/yt-dlp (once)
+cd server && bun install
+ln -s ../frontend public # once — the server serves ONLY ./public (Docker copies frontend/ there)
+bun --hot server.js      # http://localhost:3000
+node --test frontend/    # unit tests (run from repo root)
+npx playwright test      # e2e (see Testing below)
+```
+
+Local DB file: `server/data/ytplayer.db` (gitignored). `BUILD_TAG` is computed from `./public` contents.
+
 ## Production deployment (web PWA)
 - URL: **https://worship.hesed.sbs** (Traefik label in `docker-compose.yml`)
 - Runs on the **homelab** Dokploy remote node; control plane is Dokploy on the VPS
@@ -61,6 +94,12 @@ The PWA is what runs in production; `legacy/` holds the old native-only docs.
 - Test records on prod use `Probe */Recon *` names; clean via the container DB,
   children (`video_history`) first.
 
+## Harness
+
+Skills live in `.agents/skills/` (symlinked into `.claude/skills/`):
+- **deploy-prod** — the Dokploy deploy + buildTag verification flow (manual-only; use for any "deploy"/"release" request).
+- **mobile-app-ui-design** — UI/UX design work on the PWA screens.
+
 ## Commit rules
 One changeset = one commit, single-line imperative message, **no AI attribution
 of any kind** (global rule). `git push origin main` pushes to both remotes.