feat: scaffold Journal layer with configurable post route and git-install check

- journal module registers the Journal pages at journal.routes paths
- typed anonymous-GET client, html gate, SSR x-forwarded-for forwarding
- fixture API, built-server SSR smoke and git-tag install check

scripts/check-git-install.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# Usage: scripts/check-git-install.sh <tag>
+#
+# Proves the layer's distribution end to end: a scratch app installs
+# vue-journal-layer from git+https://git.golem15.com/golem15/vue-journal-layer.git#<tag>
+# anonymously, the lockfile pins the tag's commit, `nuxt build` succeeds, and
+# the built server passes testing/expect-acme.txt against the fixture API.
+# Nothing outside a temporary directory is touched.
+set -euo pipefail
+
+REPO_URL="https://git.golem15.com/golem15/vue-journal-layer.git"
+
+die() { echo "check-git-install: $*" >&2; exit 1; }
+
+TAG="${1:-}"
+[[ -n "$TAG" ]] || die "usage: $0 <tag>"
+
+for tool in git pnpm node; do
+  command -v "$tool" >/dev/null 2>&1 || die "$tool is not installed"
+done
+
+WORK="$(mktemp -d "${TMPDIR:-/tmp}/journal-git-install.XXXXXX")"
+cleanup() { rm -rf "$WORK"; }
+trap cleanup EXIT
+
+# The commit the tag points at (peeled when annotated).
+REMOTE_REFS="$(GIT_TERMINAL_PROMPT=0 git ls-remote "$REPO_URL" "refs/tags/$TAG" "refs/tags/$TAG^{}")" \
+  || die "git ls-remote $REPO_URL failed"
+TAG_SHA="$(awk -v ref="refs/tags/$TAG^{}" '$2 == ref { print $1 }' <<<"$REMOTE_REFS")"
+[[ -n "$TAG_SHA" ]] || TAG_SHA="$(awk -v ref="refs/tags/$TAG" '$2 == ref { print $1 }' <<<"$REMOTE_REFS")"
+[[ -n "$TAG_SHA" ]] || die "tag $TAG not found on $REPO_URL"
+
+cd "$WORK"
+
+cat >package.json <<JSON
+{
+  "name": "acme-blog",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "nuxt": "4.4.8",
+    "vue": "3.5.35",
+    "vue-journal-layer": "git+$REPO_URL#$TAG"
+  }
+}
+JSON
+
+cat >pnpm-workspace.yaml <<'YAML'
+allowBuilds:
+  '@parcel/watcher': true
+  esbuild: true
+  vue-demi: true
+YAML
+
+cat >nuxt.config.ts <<'TS'
+export default defineNuxtConfig({
+  extends: ['vue-journal-layer'],
+  compatibilityDate: '2025-07-15',
+  i18n: {
+    strategy: 'prefix_except_default',
+    defaultLocale: 'en',
+    locales: [
+      { code: 'en', language: 'en-US' },
+      { code: 'pl', language: 'pl-PL' },
+    ],
+  },
+})
+TS
+
+GIT_TERMINAL_PROMPT=0 pnpm install || die "pnpm install failed"
+
+# The lockfile must pin the tag's commit, not a branch.
+LOCK_SHA="$(grep -oE "vue-journal-layer[^[:space:]]*[0-9a-f]{40}|commit: [0-9a-f]{40}" pnpm-lock.yaml | grep -oE '[0-9a-f]{40}' | sort -u)"
+[[ -n "$LOCK_SHA" ]] || die "pnpm-lock.yaml records no commit for vue-journal-layer"
+[[ "$(wc -l <<<"$LOCK_SHA")" -eq 1 ]] || die "pnpm-lock.yaml records more than one commit: $LOCK_SHA"
+[[ "$LOCK_SHA" == "$TAG_SHA" ]] || die "pnpm-lock.yaml pins $LOCK_SHA, tag $TAG is $TAG_SHA"
+
+pnpm exec nuxt build || die "nuxt build failed"
+
+node node_modules/vue-journal-layer/testing/smoke-ssr.mjs \
+  --output .output \
+  --fixtures node_modules/vue-journal-layer/testing/fixtures/acme \
+  --expect node_modules/vue-journal-layer/testing/expect-acme.txt \
+  || die "SSR smoke failed"
+
+echo "check-git-install: ok $TAG $TAG_SHA"