Keep the filone.ai demo alias out of search results (FIL-897)

[pyropy]

The same deployment is served from filone.ai as well as fil.one, so demos survive
fil.one being blocklisted. That alias must not compete with fil.one in search
results or dilute it with duplicate content.

⚠️ Prerequisites

1. infrastructure#40 merged and applied — until then filone.ai redirects at the Cloudflare edge and never reaches Vercel, so this rule matches nothing.
2. filone.ai and www.filone.ai attached to this Vercel project (part of infrastructure#40's prerequisites).

Note this PR was previously closed and has been reopened. It originally targeted
filone.net, which was never registered; it now targets filone.ai, whose zone is
already Active.

Blocks

website#113 — stacked on this branch.

What changes

One host-conditional entry in vercel.json headers:

{ "source": "/(.*)",
  "has": [{ "type": "host", "value": "(www\\.)?filone\\.ai" }],
  "headers": [{ "key": "X-Robots-Tag", "value": "noindex, nofollow" }] }

Plus a README section explaining the alias, since vercel.json can't carry comments.

Escaping matters here. The JSON source needs \\.; after JSON parsing the regex
engine receives (www\.)?filone\.ai. Writing \. is invalid JSON, and writing .
unescaped turns it into a wildcard. Verified the parsed value is
(www\.)?filone\.ai.

The pattern is unanchored, so it also matches a host merely containing the alias.
That only ever over-applies noindex, which is the safe direction, so I left it
rather than risk an anchoring change that can't be verified without a Vercel preview.
Noted in the README.

Two things deliberately not done

• Canonicals need no change. index.html and useSeo already emit absolute
  https://www.fil.one/… URLs on every host, so pages served from the alias already
  point search engines at the canonical domain. Confirmed in the built output.
• robots.txt is left alone. Adding a Disallow for the alias would stop crawlers
  fetching the page at all, so they would never see the noindex header — the two
  mechanisms would cancel out and the alias could still be listed from external links.

Verification

npm run typecheck clean, npm run lint 0 errors (8 pre-existing warnings in
untouched src/components/ui/*), 32 tests pass, build + 60-route prerender green.
vercel.json validated as JSON and the parsed has.value inspected directly.

Needs a Vercel preview to confirm end to end, since has-on-headers can't be
exercised locally:

curl -sI https://<preview>/ -H 'Host: filone.ai'     | grep -i x-robots-tag   # present
curl -sI https://<preview>/ -H 'Host: www.filone.ai' | grep -i x-robots-tag   # present
curl -sI https://<preview>/ -H 'Host: www.fil.one'   | grep -i x-robots-tag   # ABSENT

That last one is the important assertion — a rule that accidentally matched fil.one
would deindex the production site.

Note

filone.ai is also the domain every production Auth0 email is sent from, and a
HubSpot campaign sender. Reputation damage earned by pages served here lands on the
domain that delivers password resets — an accepted trade recorded on
infrastructure#40, and one more
reason to keep the alias unadvertised and unindexed.

Review remediation applied

• The noindex rule moved to headers[0]. It was last, behind two entries that
  between them match every path. Vercel's headers are believed cumulative rather than
  first-match, but if that is wrong the rule never fired and this PR was a no-op that read
  as done. Moving it is free under cumulative semantics and the fix under first-match, so
  it no longer needs a preview to be safe.
• README corrected. It asserted the alias console already answers and that
  filone.ai "served a Cloudflare redirect until FIL-897" — one depends on unmerged work,
  the other describes a state that will not exist once this lands. The Linear key is out of
  the heading, and the consoleUrl() bullet moved to Point console CTAs at the console on the current hostname (FIL-897) #113, where the module it documents
  actually exists.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
fil-one	Ready	Preview	Aug 18, 2026 6:14pm

[bajtos]

All changes from this line to the end of the file seem like JSON reformatting. Can you please revert them?