docs: HTML and PDF set plus optional CORS

WhatToChange: recommended-changes/2026-09-21-docs-and-cors/
  What-to-Change.md
  What-to-Change-To.md
  How-to-implement-the-changes.md

What was actually done:
- Markdown, HTML, and PDF for standards, architecture, API, and the operator guide.
- README points at scripts/build-docs.sh.
- VERAE_MCP_CORS=1 enables CORS and JSON responses on the Streamable HTTP app.

What was not done:
- (none)

scripts/build-docs.sh

@@ -0,0 +1,40 @@
+#!/bin/sh
+# Render docs/*.md to HTML and PDF. Requires pandoc.
+set -eu
+root=$(CDPATH= cd -- "$(dirname "$0")/.." && pwd)
+cd "$root"
+mkdir -p docs/html docs/pdf
+css='body{font-family:Georgia,serif;max-width:42rem;margin:2rem auto;padding:0 1rem;line-height:1.45}code,pre{font-family:ui-monospace,monospace}table{border-collapse:collapse}td,th{border:1px solid #ccc;padding:0.3rem 0.5rem}'
+for name in standards architecture api operator-guide; do
+  pandoc "docs/${name}.md" \
+    --standalone \
+    --metadata "title=${name}" \
+    -c style.css \
+    -o "docs/html/${name}.html"
+  pandoc "docs/${name}.md" \
+    --metadata "title=${name}" \
+    -o "docs/pdf/${name}.pdf"
+done
+printf '%s\n' "$css" > docs/html/style.css
+cat > docs/html/index.html <<'EOF'
+<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<title>Verae MCP timestamping server</title>
+<link rel="stylesheet" href="style.css">
+</head>
+<body>
+<h1>Verae MCP timestamping server</h1>
+<p>Hash-only stamps for assistants that speak the Model Context Protocol.</p>
+<ul>
+<li><a href="operator-guide.html">Operator guide</a> (<a href="../pdf/operator-guide.pdf">PDF</a>)</li>
+<li><a href="architecture.html">Architecture</a> (<a href="../pdf/architecture.pdf">PDF</a>)</li>
+<li><a href="api.html">Tool API</a> (<a href="../pdf/api.pdf">PDF</a>)</li>
+<li><a href="standards.html">Standards</a> (<a href="../pdf/standards.pdf">PDF</a>)</li>
+<li><a href="../../site/index.html">Sample page</a></li>
+</ul>
+</body>
+</html>
+EOF
+echo "wrote docs/html and docs/pdf"