add: a 3D model of the Mark III, sealed, shown on request

[synaps3s]

What this adds

The Mark III entry in the Iron Man armour collection gains a "View in 3D" control. Pressed, it opens a model of the armour that can be turned, lit and taken apart, with its credit underneath.

The model and its licence

The model is "Iron Man" by -LUCIFER- on CGTrader, under the Royalty Free License (no AI). That licence allows the model to be shown inside a work and forbids handing the file out in the form it was downloaded. A public repository hands out every file in it, so the model is committed sealed:

• reduced to half its faces with no visible loss, quantised and gzipped
• encrypted with AES-256-GCM by scripts/encrypt-model.mjs
• the key lives only in the production environment as PHASE_ZERO_MODEL_KEY, read by the deploy workflow's validate and build steps

CI and every fork build without the key, and their Mark III reads exactly as it did before. A missing key is not an error.

The credit is data, in the piece's new model field, and is shown in both languages. The CGTrader page was opened by the maintainer; automated requests to it are blocked, so it could not be fetched from here.

Weight and behaviour

• The set page gains 3 KB. three.js (bundled, not a third-party script) and the model (3 MB) are fetched only on the first press, from this origin only.
• The button stays hidden until the browser has shown it can open a model. The page is complete without it.
• It holds still under reduced motion, does not trap the page's scroll, and draws only while open and on screen.

Design

Drawn in the site's own material, recorded in DESIGN.md as Piece Model: the share card's control in the piece's colour, a set card's panel with a lit top edge, a transparent canvas with no floor or backdrop, rim light from --piece-colour and glow from --tint-blue, re-read when the theme changes. Turn, lights and take apart are an ordinary switch.

Policy changes

• Content security policy: connect-src 'self', for the one request the site now makes.
• Rule 5 in CLAUDE.md, CONTRIBUTING.md and DESIGN.md records the exception and every condition it comes with.

Checked

npm run validate passes. The page was opened in a browser in English with the night theme and in Italian with the day theme, the button pressed, the model opened, and take apart tried.

Rollback

Merge with a merge commit and keep the branch. Reverting the merge commit removes everything here, and the entry returns to what it was.