fix: repair main after an unreviewed commit, and record the cause

Three separate problems, all traceable to `git add -A` sweeping up a working
tree I had not inspected.

Commit 69020b25 ("docs: make the component sections executable") committed far
more than docs: 79 files of a half-scaffolded inter-app example, and four of
those files were truncated mid-statement. That broke `bun run typecheck` on
main. The example is reverted to its last green six-file form. The truncated
fragments and the fuller working copy are NOT in this commit -- if any of that
workspace was wanted, it needs to be reconstructed deliberately and committed on
its own, not as a side effect of a docs change.

Separately, `scripts/generate-ui-complete-catalog.mjs` was run while checking
which helper scripts still work. It rewrites components in place, so it
flattened six of them to stubs, deleted 24 more and lower-cased four filenames
before crashing. Contents were restored from HEAD, but the renames survived
that restore: Windows is case-insensitive, so `git status` reported clean while
Card, Container, Divider and Grid sat on disk under the wrong names. The index
now tracks the capitalised names, which is what the components declare and what
ui-redesign-contract.test.ts reads -- that test would have failed on any
case-sensitive checkout.

Documented both as 4.7 and 4.8 in the remediation plan, with the general rule:
no script that rewrites packages/ui/components/ may write in place. Also fixes
the heading level on 4.6, which was rendering outside section 4.

bun run check is green: 1,433 pass, 0 fail.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

examples/inter-app-api-showcase/README.md

@@ -1,44 +1,19 @@
-# inter-app-api-showcase
+# Inter-app + external API showcase
 
-A WrNexus **workspace** — multiple apps, one gateway, interconnected.
+`GET /api/product-summary?sku=starter` demonstrates one request handler making:
 
-```
-inter-app-api-showcase/
-  wrnexus.workspace.ts   # apps ↔ domains map (used by `wrnexus gateway`)
-  apps/
-    web/                # a WrNexus app  → localhost, web.localhost
-    admin/              # a WrNexus app  → admin.localhost
-  packages/
-    shared/             # @app/shared — shared code + cross-app pubsub bus
+1. an RPC request to the `catalog` app (`getProduct`);
+2. an external HTTPS request to GitHub's public REST API; and
+3. an RPC request to the `audit` app (`recordLookup`).
+
+The handler deliberately forwards `as: ctx` only to WRNexus peer apps. The RPC package turns that into a short-lived subject/tenant token; it is never forwarded to GitHub. Each peer app must implement the same contract from `app/lib/contracts.ts` (normally a shared workspace package) under `app/services/`, and must authorize its own procedures.
+
+Before running this app, configure all three apps with the same private internal-origin map and a distinct, 32+ character RPC secret:
+
+```sh
+WRNEXUS_RPC_SECRET=replace-with-a-private-32-character-minimum-secret
+WRNEXUS_APP_NAME=product-summary
+WRNEXUS_INTERNAL_ORIGINS={"catalog":"http://127.0.0.1:4101","audit":"http://127.0.0.1:4102"}
 ```
 
-## Run everything (one port, routed by domain)
-
-```bash
-bun install
-bun run dev            # = wrnexus gateway  → http://127.0.0.1:3000
-```
-
-Add the hosts to your machine (e.g. /etc/hosts):
-
-```
-127.0.0.1 web.localhost admin.localhost
-```
-
-Open `http://localhost:3000` for the web app or
-`http://admin.localhost:3000` for the admin app. The ports printed for individual
-apps are internal gateway targets, not public workspace URLs.
-
-## Interconnect
-
-- **Shared code:** import `@app/shared` in any app.
-- **Runtime messaging:** `import { bus } from "@app/shared"` then
-  `bus.publish("tenant:created", {...})` in one app and
-  `bus.subscribe("tenant:*", fn)` in another (needs Redis).
-- **Databases:** point apps at the same `db`/`databases` in their config.
-
-## Add another app
-
-```bash
-wrnexus workspace add reports --domain=reports.localhost
-```
+The peer app processes must remain private; the public gateway blocks the RPC route by design. Run with `bun run --cwd examples/inter-app-api-showcase dev`.