Cross-link to the attendee app + share schedule API contract

[marykatefain]

Summary

The website is now visibly paired with the attendee app at aos-convergence.app. Every page surfaces an "Open App" affordance, and the gated event schedule served from /api/event has been extended with machine-readable date / start / end fields so the app can render and reason about the agenda using the same NIP-98 endpoint.

This is the website half of a pair of changes; the matching commits live in the convergence-app repo and ship the in-app /schedule page, the "Now happening" banner, and updated cross-links back to the website.

What changes

Cross-linking surfaces

• SiteHeader / SiteFooter — persistent "Open App ↗" CTA in the desktop nav, mobile menu, and footer. Always visible (the app is public; no auth gate on the website side).
• /event hero — schedule moved above the format mini-cards so the first content under the hero answers "what is happening when?". Hero gains a secondary "Open App" CTA next to Signal. Narrative day sections were relabelled by format (Open Space / Hackathon / Main Stage) instead of Day 1/2/3 to stop visually mimicking the timed schedule. id="schedule" anchor added.
• /program — id="event-flow" anchor on the day-by-day overview. Bottom CTA row adds "See the full timed agenda →" and "Approved? Open App ↗".
• src/lib/appLinks.ts (new) — APP_URL + WEBSITE_URL constants, overridable via VITE_APP_URL / VITE_WEBSITE_URL. Deep-link anchors for the public program flow and the gated schedule live here too.

Schedule API contract (shared with the attendee app)

• worker/src/index.ts — schedule items gain parsed start / end (HH:MM, Europe/Oslo) fields; each day gains date (YYYY-MM-DD); the response gains top-level timezone / eventStart / eventEnd. All additions are backward-compatible with the existing website rendering (which only consumes time).
• CORS is now an explicit allowlist (convergence.andotherstuff.org, aos-convergence.app, and localhost dev origins) so the app can call the same gated endpoint cross-origin. NIP-98 stays the actual per-request gate; CORS is defense in depth.

Shared design contract

• BRAND.md (new) — colors, radii, typography conventions, header lockup, CTA patterns, OG meta, and the canonical cross-link surface placement table. Both repos reference this.
• index.html — complete OG / Twitter card meta (image is a TODO awaiting the shared OG asset).
• README.md — documents VITE_APP_URL / VITE_WEBSITE_URL alongside the existing VITE_API_URL.

Tests

• SiteHeader.test.tsx (new) — smoke test asserting the "Open App" link points to APP_URL and opens in a new tab with rel="noopener noreferrer".

Validation

• tsc --noEmit: clean.
• eslint: clean on all touched files (the one pre-existing worker/src/index.ts lint error is unrelated).
• vitest: 13/13 pass (12 prior + 1 new).
• vite build: clean.

Deployment notes

The worker schedule additions (date, start, end, timezone, eventStart, eventEnd) need a cd worker && npm run deploy before the app's /schedule page can rely on them. The app falls back to parsing the time string when those fields are absent, so the rollout order doesn't matter — the app works against an un-redeployed worker, just less optimally.