#189 docs: README features first, Which setup in docs/setup.md, every claim checked

Docs only.

What changes

• The README's order: the header (intro, links, status), then Features, then a shorter Quick start, then Documentation, Packages, Agent skills, Contributing and Licence as before. 174 lines to 163.
• Which setup moves whole to docs/setup.md, as its first section (#which-setup). The README keeps its answer in one line: packages you did not make, or a site with signed-in users, play untrusted or embed the player from a domain of its own. docs/privacy.md links there, and design/layout.md says so.
• Corrected:
  • Rollup is no longer named as a bundler the Quick start works with (below), in the README and docs/setup.md;
  • "updates every week" becomes what the weekly jobs do: rebuild the pack from the hub and the interface strings from Moodle's translations, open a pull request when either changed, and play every content type in the pack, trusted and untrusted;
  • the header's "no third-party service" becomes "no service of ours or H5P Group's", as docs/privacy.md says, and the privacy bullet names jsDelivr for the pack unless a copy is served;
  • SCORM 2004 beside 1.2, each with the LMSs it was checked in;
  • "Emded H5P Lovable demo" is "Lovable example", and "Offline PWA app" is "Offline app".
• Added: version 1 since October 2026; the 53 content types the hub serves; English and 56 other languages; Chromium, Firefox and WebKit on every change and Safari by hand; both packages ship TypeScript declarations; h5p-author's packages upload to Moodle; when libraries="pack" is needed.

Checked

• The Quick start, from clean: npm, the README's files as written, and a True/False that h5p-author built. Vite 8.3.8 and webpack 5.112.2 emit the Service Worker, the jobs worker, the runtime's scripts, its stylesheet and its fonts, and the page plays in Chromium with the xapi listener logging answered. Rollup 4.68.2 with @rollup/plugin-node-resolve emits main.js alone, so nothing plays. With @web/rollup-plugin-import-meta-assets 3.0.1 the build stops on the element's default new URL("frame-assets/", import.meta.url), a folder the package does not ship.
• Each claim against its source:
  • the element's attributes, properties and events against docs/api.md, all there;
  • untrusted against docs/untrusted.md and content-check.ts, a port of H5PContentValidator;
  • the weekly jobs' schedules and last runs: the library pack and the translations passed on 2026-11-09, and the sweep played 110 of 110;
  • the hub list in build-libraries.mjs, 53 types as of 2026-10-13;
  • packages/runtime/l10n, 56 language files beside index.json;
  • docs/compatibility.md#browsers, the embed README's LMS table and docs/privacy.md;
  • NOTICE.md, zip.js in both Service Worker scripts;
  • the two packages' types, and npx skills add --skill with skills 1.8.1.
• Links: every external link answers 200. Every link into the repository names a file that exists, and every anchor names a heading.
• A cold reader, a fresh Haiku agent given the README alone and five questions, missed two things: what to do on a site with signed-in users, which sat behind the link, and whether TypeScript is covered. Both are on the page now.

Not changed

• Rollup is still named in apps/demo/demo/setup.html, skills/h5p-player-setup/SKILL.md, design/build.md, and comments in packages/player/src/h5p-offline-player.ts, packages/runtime/scripts/build.mjs and packages/libraries/scripts/parts.mjs.
• The README reaches npm with the next player release, since the player's prepack copies it; h5p-author 0.9.4 does not carry it.

---

Summary by cubic

Docs-only PR that reorganizes the README to lead with Features, shorten the Quick start, and move the Which setup table wholesale to docs/setup.md. Every claim in the README was checked against its source, and several were corrected.

• Rollup is no longer named as a supported bundler — it does not emit the Service Worker, while Vite and webpack 5 build and play the Quick start.
• The weekly line now says what the jobs actually do, SCORM 2004 joins 1.2 with the LMSs each was checked in, and the privacy claims name jsDelivr and "no service of ours or H5P Group's".
• Added version 1 since October 2026, 53 content types, 56 other languages, the tested browsers, and TypeScript declarations for both packages.
• docs/privacy.md and design/layout.md now link to the moved Which setup section; all links and anchors were verified.