Implemented phase 3 for the POC prototype in the Website service.

Services/Website/README.md

@@ -5,6 +5,7 @@ The **CCN** public website service — a [Hummingbird](https://github.com/hummin
 The service:
 - Serves the landing page at `GET /` (rendered once per supported language with [Elementary](https://github.com/elementary-swift/elementary) and cached), plus one prefixed route per non-default catalog language — `GET /nl` and so on (see [Language editions](#language-editions)).
 - Serves the public catalogue, rendered per request: search results at `GET /search` (filtered through its query parameters), a listing at `GET /listing/{slug}`, and a seller's shop at `GET /shop/{slug}`; an unknown slug gets the not-found page (see [Catalogue](#catalogue)).
+- Serves the path to a sale, for signed-in accounts: the offer sheet, the messages, the sale records, and the seller dashboard (see [Path to a sale](#path-to-a-sale)).
 - Serves the gate: the sign-in screen at `GET /sign-in`, the sign-in at `POST /sign-in`, and the sign-out at `POST /sign-out` (see [Sign-in](#sign-in)).
 - Negotiates each request's language from the `lang` query parameter, the leading path segment, then its `Accept-Language` header, against the languages in the `WebsiteLibrary` String Catalog, falling back to the default (`en`) — asked for only where the answer is used, the bare landing route and the not-found page; pages are served from the per-language cache with `Content-Language` and `Vary: Accept-Language` headers.
 - Builds every page on the shared `Page` scaffolding from `Infrastructure`, which assembles the document head around the page's own markup: the viewport declaration, the optional `description` summary and `rel="canonical"` link, the Open Graph / Twitter link-preview tags, the JSON-LD structured-data script, and the optional analytics tracker (see [Page metadata](#page-metadata)).
@@ -50,6 +51,7 @@ LogRequestsMiddleware
 RootController                            (GET / → landing page, language negotiated; GET /<lang> → its other editions)
 CatalogueController                       (GET /search, GET /listing/{slug}, GET /shop/{slug} → rendered per request)
 SessionController                         (GET /sign-in, POST /sign-in, POST /sign-out)
+TradeController                           (offer sheet, messages, sale records, seller dashboard → signed-in accounts only)
 HealthController                          (GET /health → liveness, GET /health/ready → readiness)
 ```
 
@@ -64,9 +66,9 @@ The screens follow the **CCN marketplace** design canvas:
 
 ### Catalogue
 - **Data**: `Persistence`'s `CatalogueRepository` reads the shops and listings; the in-memory backend is migrated and seeded with demo data at launch.
-- **Landing page**: rendered once and cached, so its listing rows are a snapshot taken at launch (`HomeListings`).
+- **Landing page**: rendered once and cached, so its listing rows are a snapshot taken at launch (`HomeListings`) — a copy sold since still shows there until the next launch.
 - **Search and shop**: `SearchParameters` turns the query string into a `ListingFilter` and builds every link that changes it — filter pills, tabs, pagination — so the screens work as plain `GET` forms and links. Searches default to listings shipping from the EU.
-- **Gated actions**: signed out, buy, offer, message, save, and follow link to the sign-in screen with a `return` parameter; signed in, buy, offer, and message link to their own paths (not built yet), while save and follow render disabled.
+- **Gated actions**: signed out, buy, offer, message, save, and follow link to the sign-in screen with a `return` parameter; signed in, buy, offer, and message lead on (see [Path to a sale](#path-to-a-sale)), while save and follow render disabled. A sold copy, and a seller's own listing, show no actions.
 - **Covers**: listings have no photos yet, so `Cover` draws a placeholder from the listing's lettering and tone.
 - **Scripts**: `js/shared.js` only submits the sort select on change and opens the filter rail on older desktop browsers; everything works without it.
 
@@ -79,6 +81,20 @@ The screens follow the **CCN marketplace** design canvas:
 - **Per-viewer pages**: the controllers read the viewer from the request and send those pages `Cache-Control: private, no-cache`. The landing page stays cached for signed-out visitors and is rendered per request for signed-in ones.
 - **Sign-out** is a `POST` form in the header, so a link on another site cannot trigger it. The not-found page always renders signed out.
 
+### Path to a sale
+| Route | Screen |
+| --- | --- |
+| `GET`/`POST /listing/{slug}/offer` | The offer sheet: an amount, one-tap picks (plain links, so they work without scripts), and a note. |
+| `GET`/`POST /listing/{slug}/buy` | The same sheet, confirming a purchase at the asking price. |
+| `GET /messages`, `GET`/`POST /messages/{id}`, `GET /messages/new` | The conversations rail and the open conversation: messages, offer cards, and the events of the sale. |
+| `GET`/`POST /sales/{number}` | The sale record: what was agreed, frozen, and the five-step handshake. |
+| `GET /sell`, `POST /sell/offers/{id}` | The seller dashboard and the answer to an offer. |
+
+- **The rules live in `Persistence`**: `TradeRepository` decides who may offer, answer, or take a step; `TradeController` only maps a refusal to the sheet re-rendered with a `422`, or to a redirect that changes nothing.
+- **Privacy**: a conversation or sale the account is no party to is not found, rather than forbidden.
+- **Demo accounts**: every seeded shop has an owner; sign in as `joost@kestrelrow.example` to sell for Kestrel Row Comics.
+- **Left out**: counter-offers, problem reports and disputes, the PDF record, price guidance, vacation mode, and new listings.
+
 ### Page metadata
 Each page conforms to `Infrastructure`'s `Page` protocol and supplies only its `title`, `content`, `stylesheets`, and `scripts`; the protocol assembles the document around them and renders the head in a fixed order: the viewport declaration, the `analytics` origin preconnect hint, the `summary`, the `canonicalURL` link, the `socialCard` tags, the `structuredData` script, the `analytics` tracker script, then the page `metadata` and the stylesheet links. The body is the content followed by the script tags.