Contract verification page, cache-busted assets, no-withdrawal line

/contract: plain-language security review with the six design laws, honest
operator CAN/CANNOT lists, split walkthrough, oracle bridge and anti-stall
notes, testing summary, live explorer + Sourcify verified-source links
(config-driven so it follows the mainnet flip). Nav gains The contract.
All asset URLs now carry a version query so deploys bust browser caches
(the level-cycler stall). Earn-deeper checklist leads with: no withdrawal
requests, ever.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

public/assets/common.js

@@ -32,6 +32,7 @@ window.IAP = (function () {
       + '<a href="/" data-p="home">How it works</a>'
       + '<a href="/#ladder" data-p="pricing">Ad packages</a>'
       + '<a href="/ledger" data-p="ledger">Live ledger</a>'
+      + '<a href="/contract" data-p="contract">The contract</a>'
       + '<a href="/my" data-p="my">Members</a>'
       + '</span><span id="navWallet" class="muted">…</span></div>';
     document.body.prepend(nav);

public/assets/contract.js

@@ -0,0 +1,13 @@
+// Contract page: inject live address, chain, explorer + verified-source links.
+(async function () {
+  await IAP.renderNav('contract');
+  const c = await IAP.getConfig();
+  const $ = IAP.$;
+  $('cAddr').textContent = c.contract.slice(0, 10) + '…' + c.contract.slice(-6);
+  $('cChain').textContent = c.chainName;
+  $('mockAddr').textContent = c.contract.slice(0, 18) + '…';
+  $('lnkExplorer').href = c.explorer + '/address/' + c.contract + '#code';
+  const src = 'https://repo.sourcify.dev/contracts/full_match/' + c.chainId + '/' + c.contract + '/';
+  $('lnkSource').href = src;
+  $('lnkSource2').href = src;
+})();