add Danny Kotan, make web friend cards text-only 2x2 on phones

agents.md

@@ -128,7 +128,10 @@ Themes: `web` = default frosted-glass website (sidebar + content, light/dark),
   section nav, light/dark switch, desktop switch, contact/clock) beside a single
   content column of `.glass` panels: hero (with a compact "Find me" socials row),
   a `.web-quick` 2-up ("Right now" + "Gym PRs"), then services, activity,
-  projects, hardware, features (Revival/RustyWolf) and friends. Projects/hardware
+  projects, hardware, features (Revival/RustyWolf) and friends. Friend cards are
+  **text-only** (name + domain — the web theme does not render `Friend.img`
+  avatars) in a `.friends-grid` that collapses to a 2×2 grid on phones.
+  Projects/hardware
   use a CSS multi-column **masonry** gallery (`.project-grid`) so short cards
   don't leave half-empty grid slots. The two feature panels (`.web-split`) stretch
   to equal height and share a fixed `16 / 10` `.web-shot` frame with
@@ -242,11 +245,12 @@ with icons, it's almost certainly here.
    exceeded" (this bug has already happened once — see history below).
 
 ### Gotcha: native drag hijacks the pointer gesture
-Icons whose glyph is an `<img>` (the friend shortcuts, which use `next/image`
-with `/skopec.svg`, `/bukovina.svg`, `/vlcak.svg`) can start the browser's
+Icons whose glyph is an `<img>` (the friend shortcuts that carry `Friend.img`,
+e.g. `/skopec.svg`, `/bukovina.svg`, `/vlcak.svg`) can start the browser's
 **native image drag**, which fires `pointercancel` and kills the custom drag.
-Emoji-based icons are unaffected, which makes this look like "only some icons
-don't drag".
+Emoji-based icons are unaffected — including a friend with no `img` (`Friend.img`
+is optional now; it falls back to the 🫂 glyph), which makes this look like
+"only some icons don't drag".
 
 Guard (already in place, keep it that way):
 - `draggable={false}` on the `<Image>` in `renderIcon`.
@@ -374,9 +378,11 @@ knows about icon ids, via `APP_BY_ID`.
 - Friend shortcuts reuse the same embed path, driven by `data.ts`. `friend.iframe`
   is the `embed` flag; `friend.url` is what the frame loads and `friend.realUrl`
   is what the www button opens — `createWebsiteApp`'s `embedUrl` option lets the
-  two differ. `bukovinafilip.com` and `vlcak.me` send no framing headers, so they
-  frame the live site. `skopec.dev` sends `X-Frame-Options: SAMEORIGIN` on every
-  path, so `friend.proxy` routes it through `/api/frame`.
+  two differ. `bukovinafilip.com`, `vlcak.me` and `k0t4tkos-portfolio.com` send
+  no framing headers, so they frame the live site. `skopec.dev` sends
+  `X-Frame-Options: SAMEORIGIN` on every path, so `friend.proxy` routes it
+  through `/api/frame`. `Friend.img` is optional and only feeds the desktop icon
+  / FriendsApp avatar — the web theme's friends section is text-only.
 - `/api/frame` is a **host-allowlisted** header-stripping proxy for sites that
   refuse framing. It fetches the HTML server-side (so the upstream
   `X-Frame-Options` never reaches the browser), injects `<base href="origin/">`