One file owns the court: beats.js, PROJECT.md (né HANDOFF), and tests gate the build

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Dockerfile

@@ -1,3 +1,11 @@
+# STAGE 1 — the test gate. `node test.js` drives the real game modules headless; if the state
+# machine breaks, this stage fails, the image never builds, and the deploy never ships. The final
+# stage COPYs the marker so BuildKit cannot skip this stage as unused.
+FROM node:22-alpine AS test
+WORKDIR /app
+COPY *.js /app/
+RUN node test.js && touch /tests-passed
+
 FROM python:3.12-alpine
 # Was nginx:alpine. The leaderboard needs one process that can WRITE, and nginx is not one.
 # Everything the nginx conf was doing here — no-cache so a deploy is picked up on a plain reload,
@@ -5,6 +13,7 @@ FROM python:3.12-alpine
 # app — is a few lines in server.py. Standard library only: no pip, no requirements file.
 # ponytail: switch to hashed filenames if traffic ever matters.
 WORKDIR /app
+COPY --from=test /tests-passed /tmp/tests-passed
 COPY index.html manifest.webmanifest *.js server.py /app/
 COPY assets /app/assets
 # THE SCORES LIVE HERE AND THIS MUST BE A PERSISTENT VOLUME. Without one the json sits in the