feat: ✨ lazily-loaded Gerber viewer demo in the blog, served from R2

Embed KiCad's gerbview WASM in the graphics-to-WebGL blog post as a
click-to-load demo that opens the tiny_tapeout board entirely in-browser.

- GerberDemo.astro: lazy iframe embed + cross-origin-isolation reload guard
  + WebGL2/SharedArrayBuffer feature-detect with a poster fallback
- public/gerber-demo/{index.html,boot.js}: self-contained gerbview boot
  harness (config seed, MEMFS board preload, argv auto-open)
- board/ tiny_tapeout layers + poster.png committed; wasm/ glue JS committed
  (served same-origin — pthread worker can't be cross-origin), while
  gerbview.wasm + kicad-resources.bin are git-ignored and served from
  Cloudflare R2 (assets.pcbjam.com)
- COOP/COEP require-corp scoped to the post + /gerber-demo routes
  (dev: astro.config.mjs + middleware.ts; prod: vercel.json)
- post converted to MDX (@astrojs/mdx) so it can embed the component
- scripts/: sync-demo-wasm.sh, r2-deploy.sh, r2-cors.json

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

site/scripts/r2-cors.json

@@ -0,0 +1,18 @@
+{
+  "rules": [
+    {
+      "allowed": {
+        "origins": [
+          "https://pcbjam.com",
+          "https://www.pcbjam.com",
+          "https://*.vercel.app",
+          "http://localhost:4321"
+        ],
+        "methods": ["GET", "HEAD"],
+        "headers": ["*"]
+      },
+      "exposeHeaders": ["Content-Length", "Content-Encoding", "Content-Type"],
+      "maxAgeSeconds": 86400
+    }
+  ]
+}

site/scripts/r2-deploy.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# Deploy the heavy Gerber-viewer binaries to Cloudflare R2.
+#
+# Prereqs (one-time, done by you — see the chat guide):
+#   1. R2 enabled on your Cloudflare account (dashboard; needs a payment method).
+#   2. `wrangler login`  (browser auth).
+#
+# This script then (idempotent — safe to re-run after a rebuild):
+#   - creates the bucket (skips if it already exists)
+#   - sets CORS (site/scripts/r2-cors.json)
+#   - enables the public r2.dev URL and prints it
+#   - gzips gerbview.wasm and uploads it (Content-Encoding: gzip) + kicad-resources.bin
+#
+# Usage:  site/scripts/r2-deploy.sh [bucket-name]      (default: pcbjam-assets)
+set -euo pipefail
+
+BUCKET="${1:-pcbjam-assets}"
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"   # = site/
+SRC="$ROOT/public/gerber-demo/wasm"
+TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT
+
+command -v wrangler >/dev/null || { echo "wrangler not found (npm i -g wrangler)"; exit 1; }
+wrangler whoami >/dev/null 2>&1 || { echo "Not logged in. Run: wrangler login"; exit 1; }
+[[ -f "$SRC/gerbview.wasm" ]]        || { echo "Missing $SRC/gerbview.wasm — run scripts/sync-demo-wasm.sh"; exit 1; }
+[[ -f "$SRC/kicad-resources.bin" ]]  || { echo "Missing $SRC/kicad-resources.bin — run scripts/sync-demo-wasm.sh"; exit 1; }
+
+echo "==> Bucket: $BUCKET"
+wrangler r2 bucket create "$BUCKET" 2>/dev/null \
+  && echo "    created" \
+  || echo "    already exists (continuing)"
+
+echo "==> CORS"
+wrangler r2 bucket cors set "$BUCKET" --file "$ROOT/scripts/r2-cors.json"
+
+echo "==> Public r2.dev URL (makes the bucket's objects publicly readable)"
+wrangler r2 bucket dev-url enable "$BUCKET" || true
+wrangler r2 bucket dev-url get "$BUCKET" || true
+
+echo "==> gzip gerbview.wasm"
+gzip -9 -c "$SRC/gerbview.wasm" > "$TMP/gerbview.wasm.gz"
+echo "    $(du -h "$SRC/gerbview.wasm" | cut -f1) -> $(du -h "$TMP/gerbview.wasm.gz" | cut -f1) gzipped"
+
+echo "==> Upload gerbview.wasm (gzip, application/wasm)"
+wrangler r2 object put "$BUCKET/gerbview.wasm" --remote \
+  --file "$TMP/gerbview.wasm.gz" \
+  --content-type "application/wasm" \
+  --content-encoding "gzip" \
+  --cache-control "public, max-age=3600"
+
+echo "==> Upload kicad-resources.bin (octet-stream, no encoding)"
+wrangler r2 object put "$BUCKET/kicad-resources.bin" --remote \
+  --file "$SRC/kicad-resources.bin" \
+  --content-type "application/octet-stream" \
+  --cache-control "public, max-age=3600"
+
+echo ""
+echo "Done. Copy the r2.dev URL printed above (https://<hash>.r2.dev) into"
+echo "site/public/gerber-demo/boot.js -> R2_BASE, then redeploy the site."
+echo "(Or bind a custom domain: wrangler r2 bucket domain add $BUCKET --domain assets.pcbjam.com)"

site/scripts/sync-demo-wasm.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Mirror the gerbview WASM build outputs into the blog demo's local asset dir.
+#
+# Phase A (local verification) serves the viewer from these files. They are
+# git-ignored (see site/.gitignore): the 52 MB gerbview.wasm must never be
+# committed or shipped to Vercel — in production the heavy binaries live on
+# Cloudflare R2 (see the blog-demo plan, Phase B). Re-run this after rebuilding
+# gerbview to refresh the local copy.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
+SRC="$ROOT/output"
+DST="$ROOT/site/public/gerber-demo/wasm"
+
+mkdir -p "$DST"
+for f in wx.js wx-dom.js gerbview.js gerbview.wasm images.tar.gz; do
+  if [[ ! -f "$SRC/$f" ]]; then
+    echo "ERROR: missing $SRC/$f — build gerbview first (docker/build.sh)." >&2
+    exit 1
+  fi
+done
+
+cp "$SRC/wx.js"         "$DST/wx.js"
+cp "$SRC/wx-dom.js"     "$DST/wx-dom.js"
+cp "$SRC/gerbview.js"   "$DST/gerbview.js"
+cp "$SRC/gerbview.wasm" "$DST/gerbview.wasm"
+# Store the resources tarball WITHOUT a .gz extension: dev servers (Vite/sirv)
+# and some CDNs auto-add `Content-Encoding: gzip` for `*.gz`, which makes the
+# browser pre-decompress it — then KiCad's own gunzip fails. boot.js fetches
+# this name and writes it into MEMFS as images.tar.gz.
+cp "$SRC/images.tar.gz" "$DST/kicad-resources.bin"
+
+for f in wx.js wx-dom.js gerbview.js gerbview.wasm kicad-resources.bin; do
+  echo "synced $f ($(du -h "$DST/$f" | cut -f1))"
+done
+echo "Local demo WASM ready at $DST"