polyvisor demos

• TodoMVC surface spike — the app is a wasm component driving a curated DOM surface; no app JS (design, source).
• End-to-end TodoMVC demo — the surface app over the real engine (automerge + keyhive + subduction + storage) under polyengine: three replicas, two sync paths, live revocation. The live path rides n0's public relay; the storage pane takes your own S3-compatible endpoint or a Dropbox app via the Storage… dialog, whose provider config panels are themselves sandboxed components (design, visor, source). Dropbox note: the Connect Dropbox (OAuth) button needs this page's URL registered as a redirect URI in your Dropbox app console; pasting a console-generated access token works without that.