fix: reconnect the live plumbing (contact form, Writing, analytics)

[dommango]

Summary

Implements docs/plans/01-reconnect-live-plumbing.md. Three things are dead on the live site today because the deploy build never receives the secrets they need:

• Contact form can't send — NEXT_PUBLIC_EMAILJS_* isn't in the build env, so every submission gets "Email service not configured."
• Writing section never appears — POSTS was empty; a real post ("The game had already started", 2026-08-04) now ships committed, since the CI fetch is blocked by Substack (403 on GitHub's IP range).
• No analytics — NEXT_PUBLIC_GOATCOUNTER_SITE wasn't wired into the build either.

A fourth item (chat widget) gets a stopgap here — plan 06 replaces it properly.

Changes

• .github/workflows/deploy.yml — pass EmailJS/reCAPTCHA/GoatCounter secrets into a single Build Next.js step; scripts/check-build-env.js fails the build loudly if a required var is missing (all in one env block, so guard and build can't drift).
• lib/services/emailjs.ts — drop the misleading to_name/to_email params (the EmailJS template's own "To email" field controls the real recipient).
• app/layout.tsx / new components/chat/ChatBotGate.tsx — chat widget only mounts when NEXT_PUBLIC_CHAT_API_URL is set, via a client-only dynamic import so the stale offline-answer copy is excluded from the shipped bundle entirely, not just unrendered.
• scripts/fetch-substack.js + new scripts/lib/parse-substack-json.js — browser-like User-Agent, plus a JSON-API fallback source for when the RSS route is challenged. Fixed an entity-decoding bug found in review (numeric/named HTML entities like — weren't decoded, so the live post's em dash would have rendered as literal text).
• lib/content/writing.ts — committed the real fetched post (fetched from a residential connection; GitHub Actions' IP range is blocked).
• e2e/not-found.spec.ts / __tests__/not-found-redirects.test.ts — updated for the now-true hasPosts() state (plan 07's branded-404 tests assumed no posts existed).

Before merging

This PR's own CI doesn't need secrets (by design — ci.yml builds without them so PRs from forks work). But merging to main will fail the deploy until these exist, because of the new guard step:

1. Set the required secrets from .env.local (I can't read that file myself):

   for k in NEXT_PUBLIC_EMAILJS_SERVICE_ID NEXT_PUBLIC_EMAILJS_TEMPLATE_ID NEXT_PUBLIC_EMAILJS_PUBLIC_KEY NEXT_PUBLIC_RECAPTCHA_SITE_KEY; do
     v=$(grep "^$k=" .env.local | cut -d= -f2-)
     if [ -n "$v" ]; then printf '%s' "$v" | gh secret set "$k"; echo "set $k"; else echo "SKIP $k (empty)"; fi
   done
   gh secret list

2. In the EmailJS dashboard, confirm the template's "To email" field is hard-coded to your address (not {{to_email}}) — this PR removes the params that made that field work today. If it's still {{to_email}}, wire it to your address before merging, or the form will 422 for every visitor instead of just mis-routing.
3. Also worth confirming while you're there: EmailJS allowed-domains restricted to dommango.github.io, since this PR is the first time the service/template/public-key triple ships in a public bundle.

Test plan

• npx tsc --noEmit, npm run lint (2 pre-existing, unrelated errors in TravelMap.tsx/vitest.setup.ts — confirmed unchanged by this diff)
• npm test -- --run — 27/27 pass
• npm run build — confirmed out/index.html has id="writing" and the real post text; confirmed the chat chunk is built but not referenced from index.html
• npx playwright test — 25/25 pass
• After merge + secrets set: send a real message through the live contact form, confirm it lands in the inbox
• After merge: curl -s https://dommango.github.io | grep -c goatcounter → should be ≥ 1
• Check /dashboard-m7x9k2 in a couple days for non-zero page views

🤖 Generated with Claude Code