Vendored third-party ESM modules, served locally so client-side verify pages don't depend on
a third-party CDN at runtime (a "recompute yourself, don't trust us" page shouldn't itself
require trusting esm.sh/unpkg/jsdelivr).

- `noble-post-quantum/` — from `@noble/post-quantum@0.4.1` (MIT, Paul Miller). Only the ESM
  files actually needed for ML-DSA-65 + SLH-DSA-SHA2-192s verify (`ml-dsa.js`, `slh-dsa.js`,
  `_crystals.js`, `utils.js`) — not the full package (KEM, other parameter sets, CJS build).
- `noble-hashes/` — from `@noble/hashes@1.8.0` (MIT, Paul Miller), the transitive dependency of
  the above. Only `sha3.js`, `sha2.js`, `_md.js`, `hmac.js`, `utils.js`, `crypto.js`, `_u64.js`.

Pinned to `0.4.1` specifically per trustless-ai/Merlini's build note (2026-07-30): 0.5+ moved
`@noble/post-quantum` onto a v2 `@noble/hashes`/`@noble/curves` stack that conflicts with viem's
v1-stack imports under a flat resolver (bun/pnpm). We don't use viem, but staying pinned keeps
us byte-identical with the shared `pq-key-binding-v0` conformance suite's reference JS
implementation.

Original license files kept alongside (`LICENSE` in each subdirectory, both MIT).

Served via `/static/vendor/<path>` (routes/static_meta.py). Bare specifiers resolved through
the `/verify` page's own `<script type="importmap">` — see routes/cards.py.