docs(site): align canonical public service roles

[ORESoftware]

Outcome

Aligns the public site and README with the reviewed service boundary:

Zed supplements ecosystem-native package managers; it does not replace them.

The site now identifies api.zpkg.net as the metadata/control plane, registry.zpkg.net as immutable artifact delivery, app.zpkg.net as the canonical browser UI, and user.zpkg.net as an optional redirect. It removes the stale comment that assigned the API role to the registry hostname and the UI role to web.zpkg.net.

Honesty boundary

The README explicitly says that naming a planned endpoint is not proof that it is operational. The current registry incident remains open; this PR does not claim a deployment or DNS cutover.

Validation

• locked Astro dependency version resolved as 5.18.2
• production astro build completed successfully
• generated HTML contains the exact product wording plus api.zpkg.net and registry.zpkg.net
• python3 -m py_compile tests/site_contract.py
• git diff --check

The full Playwright contract is left to the pinned GitHub Actions job because the local workspace does not include Python Playwright/Chromium.

Tracking

Organization contract PR: zed-pkg/.github#49

Linear incident document: https://linear.app/denman/document/public-registry-reliability-r2-mirroring-and-incident-recovery-2026-08-5f461fd0bb83