feat: add dedicated marketing site

[murilopmachado]

Summary

Adds a full GitHub Pages marketing site at web/ for structlint:

• Topbar + hero with a live-simulated structlint validate terminal demo, built from the tool's real violation codes (unallowed_directory, disallowed_file_pattern, placement_violation, missing_required_file, boundary_violation)
• "How it works" mechanism grid: directory rules, file naming rules, placement/required groups, import boundaries
• Integrations table: GitHub Action, Setup action, pre-commit hook, SARIF/code scanning
• 4-step commands/fix-loop guide (init --infer → validate → suggest → hook install)
• 4 use-case cards grounded in the README
• Install section using the real curl | sh install command
• Full SEO head block (OG/Twitter using the repo's real doc/banner.png, canonical, SoftwareApplication JSON-LD), robots.txt, sitemap.xml
• Pages deploy workflow scoped to AxeForging/structlint

Uses the shared AxeForge brand kit (axeforge.css, relay flavor) byte-identical to the sibling sites (gumshoe, heyra, rsvp-m5).

Impeccable audit -- final score 20/20

Ran the mechanical detector plus a full manual 5-dimension audit (3 rounds, re-verified after each fix with a real headless-browser render, not assumption).

Dimension	Score	Why
Accessibility	4/4	Contrast computed and verified (text-muted 6.8:1, accent 6.9-7.1:1 on relay dark bg); global :focus-visible ring, never suppressed; clean h1→h2→h3 hierarchy; prefers-reduced-motion handled at both CSS (animation: none) and JS (setInterval skipped) layers with state preserved -- the seed findings still render, only the auto-cycling stops.
Performance	4/4	All animations are transform/opacity only (pulse dot, feed-line entrance); hover-only transitions (border-color/box-shadow) on cards/buttons; Google Fonts loaded with display=optional to avoid font-swap CLS; the one large image (banner.png) is only referenced via OG/Twitter meta, never rendered on-page, so it doesn't touch the page's own load.
Theming	4/4	Every color/spacing/radius/font value routes through var(--af-*) tokens; the only literal hex colors are the severity dots (info/warn) and a neutral shadow, matching the same justified-status-color pattern already used in the shared kit.
Responsive	4/4	Verified with a real headless Chromium render (not assumption): document.documentElement.scrollWidth === clientWidth at both 375px and 1440px, before and after fixes. Found and fixed a real bug: the integrations table (long CLI tokens like AxeForging/structlint/.github/workflows/...) blew its .table-scroll container out to 792px on a 375px viewport, showing clipped text and an orphaned mid-cell word wrap with no scroll affordance -- the same "long unbroken token blows out an auto-sized container" bug class called out for CSS Grid, just manifesting in a table. Fixed with table-layout: fixed + overflow-wrap: anywhere on td/code; table now fits without needing its own scroll.
Implementation integrity	4/4	Cross-checked every violation code, CLI flag, subcommand, and config key on the page against the actual Go source (internal/validator/codes.go, internal/cli/*.go, schema/structlint.schema.json) -- all real. Found and fixed one real fabrication: the table's "Reusable workflow" row referenced .github/workflows/structlint.yml, which was removed from the repo in #5 (chore: remove reusable workflow...) five months ago; the README section documenting it was never updated. Replaced it with the "Setup action" row (AxeForging/structlint/setup@v0.6.1), which does exist and is documented.

Verified false positives (detector flags, checked in context, not just accepted):

• codex-grid-background -- the dotted radial-gradient hero background matches the same cross-site brand convention already used in gumshoe's build, not generated-UI slop.
• single-font -- the page inherits Inter (var(--af-font-sans)) globally from axeforge.css's body { font-family: var(--af-font-sans); } and uses JetBrains Mono (var(--af-font-mono)) explicitly throughout for code/CLI content; confirmed by grepping axeforge.css's font-family declarations. Two families are in use, the detector just doesn't see the inherited one.
• em-dash-overuse -- 14 literal — characters (detector's count of 21 double-counts --flag-style CLI examples like --staged/--infer inside <code>), against ~15,200 characters of visible text: a density of ~1 per 1,500 characters, well under the detector's own "near 1 per 500" saturation threshold. All are legitimate term-then-elaboration technical clauses.

Test plan

• Detector run before and after fixes (detect.mjs) -- only the 3 verified-false-positive findings remain
• Headless-browser overflow check at 375px and 1440px (scrollWidth === clientWidth) before and after each fix
• Screenshots read visually at both breakpoints after each round, no clipped/truncated content remaining
• Every violation code / CLI flag / config key cross-checked against Go source

[github-actions]

✅ PR title follows the required format

Current title: feat: add dedicated marketing site