Vela quick-app dev skill + knowledge base (S4 41mm)

- SKILL.md: toolchain, project structure, round-screen layout, TDD harness,
  input/crown findings, per-app notes
- references: gitea-publish workflow, S4 session log, historical nyan-watch notes
- README: overview + key facts

references/gitea-publish.md

@@ -0,0 +1,45 @@
+# Publishing Vela apps to the user's Gitea
+
+Self-hosted Gitea: https://gitea.oimcloud.myaddr.tools/ — account `codex-bot` (id 55, admin), email codex-bot@bots.com.
+Auth: `git config --global credential.helper store` + `~/.git-credentials` (chmod 600) holding `https://codex-bot:<token>@gitea.oimcloud.myaddr.tools`. git identity = codex-bot / codex-bot@bots.com. Token is a 40-char hex (Gitea access token).
+
+## Create a repo (Gitea API)
+
+```bash
+TOKEN=<40-char-hex>  BASE=https://gitea.oimcloud.myaddr.tools
+curl -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
+  -d '{"name":"vela-snake","description":"...","private":false,"auto_init":false}' \
+  "$BASE/api/v1/user/repos"
+```
+
+## Push source
+
+```bash
+git init -b main; git add -A; git commit -m "..."
+git remote add origin "$BASE/codex-bot/<repo>.git"; git push -u origin main
+```
+
+## Attach the .rpk as a tagged release asset (two API calls)
+
+```bash
+# 1) create release -> returns JSON with an 'id'
+curl -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
+  -d '{"tag_name":"v0.3","target_commitish":"main","name":"SNAKE 0.3","body":"..."}' \
+  "$BASE/api/v1/repos/codex-bot/<repo>/releases"
+# 2) upload the binary (multipart)
+curl -X POST -H "Authorization: token $TOKEN" -F "attachment=@dist/foo.rpk" \
+  "$BASE/api/v1/repos/codex-bot/<repo>/releases/<id>/assets?name=foo.rpk"
+```
+
+## Open an issue
+
+```bash
+curl -X POST -H "Authorization: token $TOKEN" -H "Content-Type: application/json" \
+  -d '{"title":"...","body":"..."}' "$BASE/api/v1/repos/codex-bot/<repo>/issues"
+```
+
+## Pitfalls
+- `node_modules` is a symlink → /tmp/hw/node_modules. `.gitignore` must say `node_modules` (NO trailing slash) — a trailing slash matches directories only, so the symlink was committed until fixed with `git rm --cached node_modules`.
+- `sign/*.pem` holds the signing key + cert — keep gitignored; NEVER commit private.pem.
+- `dist/` and `build/` are gitignored; the installable .rpk is delivered via a release asset, not committed to git.
+- Verify nothing secret leaked: `git ls-files | grep -E 'sign|dist|node_modules|\.pem|\.rpk'` should be empty (the node_modules symlink must also be excluded).