refactor: split the repo into self-contained validator, directory, quickstart, spec and site folders

validator/ holds mewslint (lint, css, fetch, DTD/CSS data); directory/ holds
the mews.page service (app, db, check, pages, cli) and depends on validator/;
quickstart/ holds mews-quickstart and md2mews.py for third parties who want
to create Mews content without cloning the repo; spec/ consolidates doc/ and
dtd/ with the canonical mews-0.1.css; site/ becomes a Pelican project with
the forward-facing pages as Markdown, the check form kept as a raw HTML
snippet. Root pyproject.toml is now a virtual uv workspace over validator,
directory and quickstart, with cross-cutting tests that span more than one
of them staying at the repo root. Makefile and flake.nix updated to match.

validator/tests/test_domains.py

@@ -0,0 +1,31 @@
+"""Registrable-domain comparison, which is what the same-site rules rest on."""
+
+import pytest
+
+from mews.fetch import registered_domain, same_site
+
+CASES = [
+    ("example.com", "example.com"),
+    ("img.example.com", "example.com"),
+    ("a.b.example.co.uk", "example.co.uk"),
+    ("EXAMPLE.COM", "example.com"),
+    ("example.com.", "example.com"),
+    ("a.github.io", "a.github.io"),
+    ("not-a-tld", None),
+    ("", None),
+]
+
+
+@pytest.mark.parametrize(("host", "expected"), CASES)
+def test_registrable_domain(host, expected):
+    assert registered_domain(host) == expected
+
+
+def test_subdomains_of_one_domain_are_one_site():
+    assert same_site("example.com", "img.example.com")
+
+
+def test_two_sites_on_a_shared_suffix_are_not_one_site():
+    """The reason this uses a public suffix list rather than counting labels."""
+    assert not same_site("a.github.io", "b.github.io")
+    assert not same_site("example.co.uk", "evil.co.uk")