feat: webapp DO factory worker; diigo-dump as its consumer

webapp/ (new, site-agnostic, independently deployable):
- WebApp: fluent client (pathjoin/query/withHeaders/cookies/get/post)
  as RpcTarget; flower-style unions cite NuxiNL/flower v0.11 (Jan 2019);
  url/headers private (RpcTarget property reads are RPC); Error messages
  carry no header/param values; query-stripped URLs only
- WebAppDo: per-instance authority in DO storage (survives eviction);
  one-shot configure(), refuses different-url re-configure
- WebAppFactory: newWebApp(init) -> {id, app}, at(id); ids are bearer
  capabilities and are not logged
- HTTP surface: GET / mint form (secret header keys render blank),
  POST / mint (form or JSON), POST /at/<id> drive-by-capability
- types via wrangler types (worker-configuration.d.ts, gitignored)

diigo-dump/: now a webapp consumer. The diigo knowledge is only the
mint call: url=interact_api/, UA + x-requested-with, cookie, 500ms gate.
- src/webapp.ts, src/diigo-web.ts deleted (webapp's are canonical);
  diigo.ts slimmed to dumpBookmarks + PagedGet
- /_connect is state-aware: connect form pre-mint; health check
  (count=1 probe) + re-mint path post-mint; home-page link relabeled
- mint success page: narrow field + copy button (attribute-quoting
  fixed; id in x-diigo-web-id header for scripts)
- scripts/diigo-login: askpass flow, marked OBSOLETE (page flow is
  the primary); speaks the form protocol; writes only DIIGO_WEB_ID —
  the cookie lives in DO storage, never on disk
- package.json: dev = wrangler dev -c wrangler.jsonc -c ../webapp/...
  (verified: Ready on :8787, GET / 200, /_connect 200);
  wrangler ^4.148.0 devDependency after node_modules was cleaned

TODO(webapp) in webapp/README.md: proxy-page vs primary-worker mint
form; reconsider as the UI grows.

Generated-by: opencode (GLM)

diigo-dump/README.md

@@ -15,6 +15,39 @@ worker, which fetches
 with the session cookie and shows status, `total`, and the JSON items in a
 read-only `<pre>`. GET `/` is inert — dumps happen only on explicit submits.
 
+## Structure: WebApp as a Durable Object (webapp worker)
+
+The credentialed authority is a Durable Object instance from the separately
+deployable `../webapp/` worker (service binding `WEBAPP` → its
+`WebAppFactory` entrypoint; diigo knowledge = only the mint call in
+`src/index.ts`). The instance is configured once — diigo's URL + seed
+headers (cookie, UA, x-requested-with) + 500ms rate gate — and persists
+its init in DO storage: it survives restarts, and diigo-dump or any other
+worker can reconnect purely by id. The cookie crosses the wire exactly
+once, at mint time.
+
+Setup (dev):
+
+    cd diigo-dump
+    npx wrangler dev -c wrangler.jsonc -c ../webapp/wrangler.jsonc
+    # → http://localhost:8787 (webapp is secondary, binding-only)
+
+    npm run diigo-login >> .dev.vars   # askpass for the cookie, mints the
+                                       # instance, writes DIIGO_COOKIE +
+                                       # DIIGO_WEB_ID; then restart wrangler
+    # or, no askpass: open http://localhost:8787/_connect and paste the
+    # cookie into the mint form; it prints the DIIGO_WEB_ID line to add
+
+Deployed:
+
+    cd ../webapp && npx wrangler deploy
+    cd ../diigo-dump && npx wrangler deploy
+    npx wrangler secret put DIIGO_COOKIE   # re-run diigo-login only when
+    npx wrangler secret put DIIGO_WEB_ID   # the cookie itself expires
+
+Re-login is needed only when diigo invalidates the cookie; re-minting
+(POST /_mint with the new cookie) yields a fresh id and no other changes.
+
 Provenance notes: the `user-agent` / `x-requested-with` headers and the
 `interact_api` endpoint mirror the original script; the fluent client from
 `WebApp.js` is restored in `src/webapp.ts` with `WebApp` and the rate-limit
@@ -58,9 +91,12 @@ for await (const item of dumpBookmarks({ diigoAPI: stub, pages: 2 })) {
 ## Run
 
     cd diigo-dump
-    npx wrangler dev --port 8788   # → http://localhost:8788
+    npx wrangler dev -c wrangler.jsonc -c ../webapp/wrangler.jsonc
+    # → http://localhost:8787; webapp rides along, binding-only
+    # (first run: npm run diigo-login >> .dev.vars, or the /_connect page;
+    # restart wrangler after adding DIIGO_WEB_ID)
 
 Status as of 2026-10-06: manual integration test passes — 200, `total: 1674`.
 See the project ladder in ../capsite-checklist.md; context in
 ../capsite-notes.md. This is the cookie path; the API-key path
-(diigo-ping, EmDash plugin) is still 401.
+(EmDash plugin) is still 401.