Add /training page with four self-hosted walkthrough videos

- Videos loudness-normalized to -16 LUFS (originals were ~-33 LUFS).
- Static file serving rewritten to stream with HTTP Range support so
  video seeking works; .mp4/.webm MIME types added.
- Training nav links on homepage and /start, plus a first-time callout
  on /start; training page views tracked per source in admin analytics.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server.js

@@ -39,7 +39,7 @@ function getConfig() { return readJson(CONFIG_FILE); }
 function activeSponsor(sponsors) { return sponsors.find(s=>s.status==='active') || sponsors.find(s=>s.status==='waiting') || null; }
 function getAnalytics() { try { return readJson(ANALYTICS_FILE); } catch (e) { return { sources: {} }; } }
 function recordEvent(event, source) {
-  if (!['bridge','start','click'].includes(event)) return;
+  if (!['bridge','start','click','training'].includes(event)) return;
   const s = String(source||'').toLowerCase().trim().replace(/[^a-z0-9.()\-_:/ ]/g,'').slice(0,80) || '(direct)';
   const a = getAnalytics(); if (!a.sources) a.sources = {};
   if (!a.sources[s]) { if (Object.keys(a.sources).length >= 500) return; a.sources[s] = { bridge:0, start:0, click:0 }; }
@@ -73,8 +73,24 @@ function parseCookies(req){const out={};for(const p of (req.headers.cookie||'').
 function getSession(req){const token=parseCookies(req)['ctb.sid'];if(!token)return null;const s=sessions.get(token);if(!s)return null;if(s.expires<Date.now()){sessions.delete(token);return null}return {token,...s}}
 function requireAdmin(req,res){if(!getSession(req)){json(res,401,{error:'Unauthorized'});return false}return true}
 async function bodyJson(req){return await new Promise((resolve,reject)=>{let data='';req.on('data',c=>{data+=c;if(data.length>100000){reject(new Error('Payload too large'));req.destroy()}});req.on('end',()=>{if(!data)return resolve({});try{resolve(JSON.parse(data))}catch(e){reject(new Error('Invalid JSON'))}});req.on('error',reject)})}
-function contentType(file){const ext=path.extname(file);return ({'.html':'text/html; charset=utf-8','.css':'text/css; charset=utf-8','.js':'application/javascript; charset=utf-8','.json':'application/json; charset=utf-8','.png':'image/png','.jpg':'image/jpeg','.jpeg':'image/jpeg','.webp':'image/webp','.svg':'image/svg+xml','.ico':'image/x-icon'}[ext]||'application/octet-stream')}
-function staticFile(res,file,status=200){if(!fs.existsSync(file)||!fs.statSync(file).isFile())return false;send(res,status,fs.readFileSync(file),{'Content-Type':contentType(file),'Cache-Control':['.html','.css','.js'].includes(path.extname(file))?'no-cache':'public, max-age=3600'});return true}
+function contentType(file){const ext=path.extname(file);return ({'.html':'text/html; charset=utf-8','.css':'text/css; charset=utf-8','.js':'application/javascript; charset=utf-8','.json':'application/json; charset=utf-8','.png':'image/png','.jpg':'image/jpeg','.jpeg':'image/jpeg','.webp':'image/webp','.svg':'image/svg+xml','.ico':'image/x-icon','.mp4':'video/mp4','.webm':'video/webm'}[ext]||'application/octet-stream')}
+function staticFile(req,res,file,status=200){
+  if(!fs.existsSync(file)||!fs.statSync(file).isFile())return false;
+  const size=fs.statSync(file).size;
+  const base={'Content-Type':contentType(file),'Accept-Ranges':'bytes','Cache-Control':['.html','.css','.js'].includes(path.extname(file))?'no-cache':'public, max-age=3600'};
+  const m=status===200&&req.headers.range?String(req.headers.range).match(/^bytes=(\d*)-(\d*)$/):null;
+  if(m&&(m[1]!==''||m[2]!=='')){
+    const start=m[1]===''?Math.max(0,size-Number(m[2])):Number(m[1]);
+    const end=(m[1]!==''&&m[2]!=='')?Math.min(Number(m[2]),size-1):size-1;
+    if(start>end||start>=size){res.writeHead(416,securityHeaders({'Content-Range':`bytes */${size}`}));res.end();return true}
+    res.writeHead(206,securityHeaders({...base,'Content-Range':`bytes ${start}-${end}/${size}`,'Content-Length':end-start+1}));
+    if(req.method==='HEAD')res.end();else fs.createReadStream(file,{start,end}).pipe(res);
+    return true;
+  }
+  res.writeHead(status,securityHeaders({...base,'Content-Length':size}));
+  if(req.method==='HEAD')res.end();else fs.createReadStream(file).pipe(res);
+  return true;
+}
 
 async function handleApi(req,res,pathname){
   if(req.method==='GET'&&pathname==='/health') return json(res,200,{ok:true});
@@ -127,10 +143,10 @@ const server=http.createServer(async(req,res)=>{
     if(pathname==='/health'||pathname.startsWith('/api/'))return await handleApi(req,res,pathname);
     if(req.method!=='GET'&&req.method!=='HEAD')return send(res,405,'Method Not Allowed',{'Content-Type':'text/plain; charset=utf-8'});
     let file;
-    if(pathname==='/')file=path.join(PUBLIC_DIR,'index.html');else if(pathname==='/start'||pathname==='/start/')file=path.join(PUBLIC_DIR,'start.html');else if(pathname==='/admin'||pathname==='/admin/')file=path.join(PUBLIC_DIR,'admin.html');else{
+    if(pathname==='/')file=path.join(PUBLIC_DIR,'index.html');else if(pathname==='/start'||pathname==='/start/')file=path.join(PUBLIC_DIR,'start.html');else if(pathname==='/training'||pathname==='/training/')file=path.join(PUBLIC_DIR,'training.html');else if(pathname==='/admin'||pathname==='/admin/')file=path.join(PUBLIC_DIR,'admin.html');else{
       const safe=path.normalize(pathname).replace(/^([.][.][/\\])+/, '').replace(/^[/\\]+/,'');file=path.join(PUBLIC_DIR,safe);if(!file.startsWith(PUBLIC_DIR))file='';
     }
-    if(file&&staticFile(res,file))return;return staticFile(res,path.join(PUBLIC_DIR,'404.html'),404);
+    if(file&&staticFile(req,res,file))return;return staticFile(req,res,path.join(PUBLIC_DIR,'404.html'),404);
   }catch(e){console.error(e);json(res,500,{error:'Internal server error'});}
 });
 server.listen(PORT,()=>{console.log(`Crypto Team Build sponsor router running on http://localhost:${PORT}`);if(ADMIN_PASSWORD==='changeme')console.warn('WARNING: Set ADMIN_PASSWORD before production deployment.');});