Promote OpenServer and label NicheDB as its reference implementation

[ralyodio]

OpenServer now leads with a primary link to the specification and a visible link to NicheDB’s hosting category, explicitly labeled as a reference implementation. The supporting copy makes clear that any provider can publish the spec and any directory can read it.

Validation: existing OpenServer, NicheDB hosting category and hosting-CLI directory all return HTTP200; source and JSX diff reviewed. No application behavior changes.

[github-actions]

ThreatCrush Security Scan

22 finding(s)

HIGH/CRITICAL: 3 | MEDIUM: 10 | LOW: 9

Severity	Rule	Location
HIGH	secret-private-key	plugins/credential-sharing/src/providers/ssh.ts:129
HIGH	js-host-header-trust	apps/commandboard-web/server.js:27
HIGH	js-ssrf-outbound-request	apps/pwa/public/sw.js:45
MEDIUM	js-unescaped-html-sink	apps/commandboard-web/src/main.ts:19
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/app/[[...slug]]/page.tsx:71
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/app/layout.tsx:88
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/app/pricing/page.tsx:46
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/components/breadcrumbs.tsx:43
MEDIUM	js-unescaped-html-sink	apps/logicsrc-web/src/components/site-shell.tsx:34
MEDIUM	redos-nested-quantifier	packages/opencontext/src/ids.ts:10
MEDIUM	redos-nested-quantifier	packages/opencontext/src/ids.ts:11
MEDIUM	js-timing-unsafe-mac-compare	packages/opencontext/src/validate.ts:208
MEDIUM	redos-nested-quantifier	packages/openontology/src/ids.ts:20
LOW	secret-generic-credential	apps/pwa/test/appbar.test.mjs:10
LOW	secret-aws-access-key	packages/opencontext/src/permissions.test.ts:260
LOW	secret-private-key	packages/opencontext/src/permissions.test.ts:261
LOW	secret-stripe-key	packages/opencontext/src/permissions.test.ts:262
LOW	secret-aws-access-key	packages/opencontext/src/security.test.ts:228
LOW	secret-private-key	plugins/credential-sharing/src/providers/ssh.test.ts:7
LOW	secret-database-url	plugins/credential-sharing/src/rekey.test.ts:33
LOW	secret-openai-key	plugins/credential-sharing/src/vault-encryption.test.ts:21
LOW	secret-generic-credential	plugins/credential-sharing/src/vault-encryption.test.ts:21

Snippets are redacted; ThreatCrush never prints matched credential material.