feat: shareable score links and og card images

[Gmin2]

Summary

Adds a share flow to the playground. when you score a site you now get a signed link (/play/r/) and an og image at /api/og/score, so dropping the link on x or slack unfurls a card with the score, level and domain. the result rides inside the url as an hmac signed token, no datastore, and the signature stops anyone faking a score. one env var, DUALMARK_SHARE_SECRET, signs the tokens. if its unset the playground still works, the share buttons just dont render.

Note: we need to move the snapshots into a kv cache store (vercel kv / upstash) instead of url tokens. that gives short opaque links, real expiry and revocation, and room to store the full check breakdown. currently we pack the whole result into the url as an hmac signed token, so theres no datastore to run, but the links are long and you cant expire or revoke a single one.

Changes

Fixes #42

Type

• Bug fix (non-breaking)
• New feature (non-breaking)
• Breaking change
• Spec change (requires bump in AEO_SPEC_VERSION)
• Docs / examples / tooling only

Verification

• bun run build passes
• bun run test passes
• bun run typecheck passes
• If touching examples: ran dualmark verify against the example end-to-end
• If touching /spec/: ran bun run --filter dualmark-docs sync-spec and committed the mirror

Changeset

• Added a changeset (bun run changeset) for any package with a user-visible change

[vercel]

@Gmin2 is attempting to deploy a commit to the Dodo Payments Team on Vercel.

A member of the Team first needs to authorize it.

[thepushkaraj]

Hey @Gmin2, Thanks for working on this, it's working correctly.

I have one suggestion: We can show the time it was scanned here since we already carry t.