secure dev tunnel: strip /__nextjs debug endpoints while keeping HMR

README.md

@@ -86,10 +86,11 @@ then runs `npm install` and `npm run build`:
 ### Scripts
 
 ```bash
-npm run dev     # next dev --turbopack
-npm run build   # next build --turbopack
-npm run start   # next start (production)
-npm run lint    # eslint
+npm run dev      # node scripts/dev-server.mjs (dev + live updates)
+npm run dev:next # next dev --turbopack (raw dev server, unprotected)
+npm run build    # next build --turbopack
+npm run start    # next start (production)
+npm run lint     # eslint
 ```
 
 Handy checks before shipping: `npx tsc --noEmit`, `npx eslint <files>`, `npm run build`.
@@ -101,6 +102,14 @@ on the local network and from the `beta.dvorakmortonxd.dev` tunnel. Without it N
 rejects the dev asset requests *and* the HMR WebSocket, which leaves the page un-hydrated
 (stacked icons, dead buttons).
 
+A plain `next dev` server is meant for localhost and exposes unauthenticated debug endpoints
+(`/__nextjs*` — open-a-file-in-editor, stack frames, source maps, debugger attach, restart)
+that you don't want on a tunnel. `npm run dev` therefore runs `scripts/dev-server.mjs`, a
+custom server that keeps the app and live updates (HMR / Fast Refresh) but returns `404` for
+those endpoints and `*.map` for any request that isn't a direct localhost connection.
+Localhost keeps the full dev experience; the LAN and tunnel get a plain, live-reloading
+site. To force the raw server instead, use `npm run dev:next` (don't point a tunnel at it).
+
 ## 📡 API Routes
 
 | Route | Method | What it does |
@@ -140,6 +149,8 @@ src/app/
     Clock.tsx               → live clock
     JokerLogo.tsx           → logo with click easter egg
     SlBackground.tsx        → animated ASCII train background
+scripts/
+    dev-server.mjs          → custom dev server: live updates without the dev-only debug surface
 public/                     → fonts, wallpapers, icons, friend pages, /revival-inc game, llms.txt, robots.txt, sitemap.xml
 ```