'share' in the header row, faint until hovered, brass on hover like every
button; '✓ copied' in signal for 1.2s once the link is on the clipboard —
the same readout Copyable gives.

A share glyph on a section's header POSTs the exchange — prompt, her reply,
its view blocks — to /api/share, which strips, hashes (sha256, 48 bits, the
preimage is everything the card displays), and stores it in KV for 90 days.
First write wins: an offline hash collision becomes a failed share, never a
hijack. /s/[hash] is a static server-rendered page — the exchange as a
poster, her line marked as shared, and one button into the Explorer with the
question prefilled — plus a Satori OG image on the brand palette, immutable
by content hash. Nothing from a payload ever enters a visitor's session or
the model's context; the visitor re-asks live.

The explorer routes move into an (explorer) route group so the share page
renders without the client-only shell, and both OG routes read vendored
JetBrains Mono (OFL) instead of scraping Google Fonts CSS per render.

Plugin records and ASA metadata are semi-trusted: any URL is 0.1 ALGO away.
safeHref (http/https or text) now gates the four href sites and the six img
src sites, and explorerContext strips control characters, bidi overrides,
and runaway lengths before record values reach the prompt.

Co-authored-by: Michael T Chuang <github@michaeltchuang.com>