fix(editor): rebuild script and docs cover both bundles

build-editor.sh was calling npx esbuild directly for editor-entry.js
only, leaving vocab-rank.bundle.js stale when devs used the documented
rebuild path. Switch to npm run build (the single source of truth in
package.json) so both bundles are always rebuilt together. Add
vocab-rank.bundle.js to the sha256 manifest and update the vendor README
to describe both build artifacts.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

l4d2web/l4d2web/static/vendor/README.md

@@ -1,7 +1,11 @@
 # Editor bundle vendor README
 
-`editor.bundle.js` is a pre-built IIFE produced by esbuild from
-`l4d2web/scripts/editor-src/`. It exposes `window.__editor.mount(textarea, opts)`.
+This directory contains pre-built JavaScript bundles produced by esbuild from
+`l4d2web/scripts/editor-src/`:
+
+- `editor.bundle.js` — CodeMirror 6 IIFE, exposes `window.__editor.mount(textarea, opts)`.
+- `vocab-rank.bundle.js` — vocabulary ranking helpers used by the console autocomplete.
+- `editor.bundle.css` — placeholder CSS file (always empty; cm6 injects styles at runtime via StyleModule).
 
 ## Rebuild
 
@@ -11,9 +15,10 @@ From repo root:
 ./l4d2web/scripts/build-editor.sh
 ```
 
-This runs `npm install` inside `editor-src/` then `npx esbuild`. The
-output overwrites `editor.bundle.js` and `editor.bundle.css` in this
-directory and refreshes `editor.bundle.sha256`.
+This runs `npm install` inside `editor-src/` then `npm run build`, which
+rebuilds **all bundles** (`editor.bundle.js` and `vocab-rank.bundle.js`) in one
+pass. The output overwrites the bundles in this directory and refreshes
+`editor.bundle.sha256`.
 
 The build script uses `$TMPDIR/npm-cache` (override with the
 `NPM_CACHE` env var) as the npm cache to avoid permission issues with
@@ -27,6 +32,7 @@ See `l4d2web/scripts/editor-src/package.json` for semver ranges and
 
 ## Integrity
 
-`editor.bundle.sha256` contains the hashes of the committed bundle.
-If the bundle drifts from this hash in CI / review, the artifact was
+`editor.bundle.sha256` contains the hashes of the committed bundles
+(`editor.bundle.js`, `editor.bundle.css`, `vocab-rank.bundle.js`).
+If a bundle drifts from its hash in CI / review, the artifact was
 rebuilt without committing the updated bundle.

l4d2web/l4d2web/static/vendor/editor.bundle.sha256

@@ -1,2 +1,3 @@
-910031cfc346106af240df71b9ef8069f1b38f1a4c63128392c2aa074e7e57b2  editor.bundle.js
+939e3d9ba5ae65a23b17f57050144e8444e0a6ce1b85b705055bf3dc1d9a36d4  editor.bundle.js
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  editor.bundle.css
+7fefca5b1197490283c86f6d46036aaf719cc032a3bde96483aa10f6b0ba35b1  vocab-rank.bundle.js

l4d2web/scripts/build-editor.sh

@@ -13,13 +13,10 @@ cd "$SRC"
 NPM_CACHE="${NPM_CACHE:-$TMPDIR/npm-cache}"
 npm install --cache "$NPM_CACHE"
 
-npx esbuild editor-entry.js \
-  --bundle --minify \
-  --format=iife \
-  --global-name=__editor_pkg \
-  --outfile="$OUT/editor.bundle.js" \
-  --metafile=meta.json \
-  --loader:.css=text
+# Build all bundles via npm run build (editor.bundle.js + vocab-rank.bundle.js).
+# Do not call npx esbuild directly — package.json is the single source of truth
+# for build targets so new bundles are never silently omitted.
+npm run build
 
 # cm6 injects its styles at runtime via the StyleModule machinery, so the
 # bundle does not produce a separate .css file. We create an empty
@@ -28,6 +25,7 @@ npx esbuild editor-entry.js \
 # drop it in without a template change).
 : > "$OUT/editor.bundle.css"
 
-(cd "$OUT" && shasum -a 256 editor.bundle.js editor.bundle.css > editor.bundle.sha256)
+(cd "$OUT" && shasum -a 256 editor.bundle.js editor.bundle.css vocab-rank.bundle.js > editor.bundle.sha256)
 
 echo "Built $OUT/editor.bundle.js ($(wc -c < "$OUT/editor.bundle.js") bytes)"
+echo "Built $OUT/vocab-rank.bundle.js ($(wc -c < "$OUT/vocab-rank.bundle.js") bytes)"