measure the site instead of reading a report back

Every performance decision here was made from a Lighthouse run somebody did by
hand in DevTools and typed into a conversation. That loop is slow and it is
lossy: nothing measured after a build, so three real defects sat live for weeks
— a `sizes` that overstated a column by 48px, font preloads that had gone
missing, an LCP image left lazy by a rename.

api/lighthouse.ts runs it: both form factors in about 20 seconds, four
categories, the five metrics, and every failing audit with the resources it
names. A finding that says "Improve image delivery — 32 KiB" is not actionable;
the same finding with the URL and the size served is a one-line fix.

The browser is looked for in three places before anything is downloaded —
CHROME_PATH, chrome-launcher's own search, then the Chrome-family binaries by
name, which is what finds the Brave already on this machine. chrome-launcher
THROWS rather than returning null when it finds nothing, so an unguarded call
never reaches the fallback; that is caught. Only if all three miss does
@puppeteer/browsers fetch one, as a library call rather than a postinstall,
because bun does not run postinstall for an untrusted package and a silent no-op
there would surface as a failure at the first audit.

First result: Total Blocking Time is 0 ms on both form factors, down from 130.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

manifest.ts

@@ -68,6 +68,34 @@ export const manifest: PluginManifest = {
     '@tiptap/pm': '^3.15.3',
     '@tiptap/extension-text-align': '^3.15.3',
     '@tiptap/extension-link': '^3.15.3',
+    /*
+      Lighthouse, so the site can be MEASURED from the panel that builds it.
+
+      Every performance decision on this site so far — the `sizes` a column declares, which image is
+      preloaded, whether the lightbox is parsed at load — was made by reading a report somebody ran by
+      hand in DevTools and typed back. That is slow and it is lossy: three real defects (a `sizes` that
+      overstated a column, font preloads that had gone missing, an LCP marked lazy) sat live for weeks
+      because nothing measured after a build.
+
+      A big tree, and worth saying so given bunfig.toml: ~100 transitive packages. It brings its own
+      `chrome-launcher` and `puppeteer-core`, so neither is asked for here.
+
+      `@sentry/node` arrives with it. Lighthouse's error reporting is opt-in — off unless
+      `--enable-error-reporting` — and this never passes it. See api/lighthouse.ts.
+    */
+    lighthouse: '^13.4.1',
+    /*
+      Fetches a Chrome BINARY, at runtime rather than in a postinstall.
+
+      Lighthouse needs a browser and this machine has none: Ubuntu 24.04's apt `chromium` is the snap
+      stub the iris manifest warns about, and there is no Chrome repo. Puppeteer's own download runs in
+      a postinstall, which bun does not execute for an untrusted package — it would silently install
+      nothing and fail at the first audit.
+
+      So the download is a library call the plugin makes, once, when it first needs a browser. Explicit,
+      observable, and it narrates — see api/lighthouse.ts.
+    */
+    '@puppeteer/browsers': '^3.2.2',
   },
 
   permissions: [