Document web UI interactions and content-versioned assets

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015UXA39Sh9coAx4FhRkd8R2

README.md

@@ -71,9 +71,12 @@ not just promised: the page is served with `Content-Security-Policy: connect-src
 request.
 
 Everything the desktop app does works the same way: all seven metrics, the
-overlay, lin/log toggles, absolute/relative time and draggable reference lines
-(kept per metric), plus the metrics' own reference lines (−14 LUFS, integrated
-loudness, 0 dBTP…). Analysis runs at the file's native sample rate.
+overlay, lin/log toggles, absolute/relative time, an in-plot legend, wheel zoom
+around the cursor (Ctrl: time only, Shift: values only, or scroll over an axis),
+live drag-to-pan and double-click to reset, and draggable reference lines (kept
+per metric) alongside the metrics' own guides (−14 LUFS, integrated loudness,
+0 dBTP…). The metadata panel and file list show integrated loudness, LRA and
+max true peak. Analysis runs at the file's native sample rate.
 
 Serve `web/` with any static file server, over `http://` or `https://` — no
 secure context is needed. (ES modules and workers don't load from `file://`, so
@@ -122,6 +125,10 @@ float32 paths (true peak, spectrogram dB, RMS) to ~1e-6.
 The image is nginx (unprivileged, read-only root filesystem) serving `web/` with
 `deploy/nginx.conf`, which sets the CSP and turns access logging off. There is
 nothing to persist, upload or log on the server side, so there are no volumes.
+Assets are served from a content-hashed `v/<hash>/` directory (cached
+indefinitely) while the page itself is always revalidated, so a deploy can never
+leave a browser running old scripts against a new page — even behind a CDN that
+overrides cache headers.
 
 ### Web architecture