v0.6.3 — the deploy script follows the host to FileBrowser Quantum

The deploy script only. No rules change, no game change, and the built site is byte-for-byte what
0.6.2 produced — this repairs the path that publishes it.

Found trying to publish the 0.4.9f playtest build: every deploy died with "login failed: 404 404
page not found". The File Browser host has been upgraded to FileBrowser Quantum, a fork whose API
differs from the v2.63 one deploy-web.ts was written against. Three things moved at once, each
fatal on its own: auth is a session COOKIE rather than a JWT sent back as X-Auth, so a deploy that
ignored it would authenticate and then be rejected by every upload; the password is an X-Password
header, URL-encoded, rather than a JSON body field; and the path is a query parameter, with every
resource call also having to name a `source` — Quantum can serve several named stores and refuses
any call that does not say which, a concept the v2.63 API did not have.

Rewritten against the running instance's own bundle rather than guessed, the same discipline the
v2.63 version was written with. Two things worth knowing next time: the bundle is gzip-compressed,
so it needs gunzip before it can be grepped; and an endpoint that exists answers a bad password
with 401 while a missing one answers 404, which is how each path was confirmed against the live
host without holding a password.

The source is discovered from GET /api/settings/sources — one configured source is used silently,
several makes the script stop and list them rather than deploy into the wrong store. FB_SOURCE
overrides it, FB_OTP carries a two-factor code.

Verified by deploying with it rather than by reading: 0.4.9f went up this way. This is that same
file byte-identical, brought across to the main line — both branches carried the same broken
script, so deploying 0.6.x would have failed identically.

Also removes dist-test/, an untracked hand-made copy of a v0.6.2 dist/ build that no script or test
references. build-web.ts hardcodes dist and wipes it on every run, so nothing in the repo could
have produced that directory or would ever read it. .gitignore is deliberately unchanged: the
answer for a directory that should not exist is to delete it, not to hide it.

715 tests pass, tsc clean, site builds.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "station-master",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "private": true,
   "type": "module",
   "description": "Station Master — a railroad operations game",