Covers the missing-key 503, hasKey reporting, input validation without an
upstream call, the hazy-to-decisive override, upstream failures preserving
status plus fallback, and deterministic offline fallbacks.
Also points "main" at server.js, since index.js did not exist.
A failed upstream call returned HTTP 200 with a hash-derived answer that the UI
rendered with the same P(FAVORABLE) and CONFIDENCE figures as a real decision.
The fallback is now badged OFFLINE with those derived numbers blanked out.
Request errors also rendered "SIGNS POINT TO YES" and always reported a network
timeout. Failures now show CANNOT PREDICT and the real HTTP status or backend
message, and the stored history is validated before use so a malformed value
cannot break the whole interface.
The key was committed to three backends behind `|| DEFAULT_KEY` fallbacks, which
also meant a misconfigured deploy silently billed the bundled key instead of
failing. It is now read from the environment only: /api/ask answers 503 and
/api/status reports hasKey:false when it is absent.
hasKey was unreachable-false as well, via `|| true` in the Pages function and
`|| DEFAULT_KEY` in the worker, so it could never signal a missing key.
All responses now go through a shared json() helper, so error paths carry the
same CORS headers and content type as success paths, and wrangler.json declares
the ASSETS binding the worker's static fallback already referenced.
