Deploy the mindmap to GitHub Pages

[nhyiramante1]

Adds the GitHub Pages deployment path for prototype-mindmap, so the tool can be served at its own origin (https://mindmap.thoughtful-ai.com/) rather than from the add-in container.

Nothing here deploys anything. The workflow only deploys on a manual workflow_dispatch from main; pull requests build and verify only.

What's here

• .github/workflows/deploy-mindmap-pages.yml — build-and-verify on PRs; deploy only via manual dispatch from main. Read-only permissions for the build job; pages: write / id-token: write scoped to the deploy job.
• scripts/verify-pages-build.mjs + npm run verify:pages — fails the build if the backend URL is missing/malformed/not HTTPS, if dist/index.html is absent, if the production API base doesn't appear in the compiled output, or if a localhost reference or .env file made it into the artifact.
• e2e-pages/ + playwright.pages.config.ts + npm run test:e2e:pages — Playwright run against the compiled dist via vite preview: launch gate on direct access, mocked grant exchange, launch params scrubbed from the URL, bearer on subsequent requests, no console/asset errors. The existing dev-server suite is unchanged.
• mindmap-tests.yml — runs the production build, artifact verification, and the new production-bundle smoke.
• .env.production — public browser config only (VITE_BACKEND_URL, VITE_REQUIRE_LAUNCH). No secrets reach the Pages build. Provider transport/model/reasoning-effort intentionally inherit their api.ts defaults rather than being duplicated here.

Vite's base stays at root — the mindmap has no client-side routing, so no 404.html or SPA fallback is needed. No CNAME is checked in.

One test is deliberately skipped

e2e-pages/pages-smoke.spec.ts:110 is marked:

// Unskip after #579 merges — depends on the wt_api launch schema.

It asserts a launch uses the platform-supplied API base rather than the build-time fallback, and that the build-time backend receives no request. That contract only exists in #579, so it can't run yet.

Before this can merge

1. Include backend API URL in tool launches #579 lands on main.
2. This branch is rebased onto it.
3. The wt_api smoke test is unskipped and green.
4. The tool/device-client split lands (otherwise every launch 400s — mindmap isn't in the tool allowlist yet).
5. DNS: mindmap.thoughtful-ai.com CNAME'd to aitoolslab.github.io, Pages enabled with the custom domain, and HTTPS issued. GitHub allows up to 24h for the certificate — until it's live the site is http-only, and with origin binding http:// won't match the launched https://, so launches fail in that window. Expected, not a bug.

The mindmap tile also stays off until the add-in is rebuilt with VITE_ENABLE_MINDMAP_TOOL=true — that's a separate build and not affected by anything in this PR.