Reference section rework and a batch of audio converter improvements

A busy week. Some visible additions, some quieter fixes, and a lot of small polish behind the scenes.

The /reference/ landing page used to be a bare category list with a generic title. It's now a proper "find the right building block" page: a per-type grid with counts and one-line descriptions, plus a curated shortlist of the entries people actually look up. The AMIAsterisk Manager Interface. A TCP socket API for monitoring events and issuing actions in Asterisk, commonly used by click-to-dial integrations and dashboards. Events category got the same treatment with a manager.conf snippet and a working client example inline, since it's the largest reference category and the biggest single traffic source from search. A handful of high-intent reference pages (PJSIP_HEADER, PJSIP_SEND_SESSION_REFRESH, CDRCall Detail Record. The per-call accounting data Asterisk writes (start, answer, and end times, duration, disposition) to files or databases., and the top AMI events) also got custom SEO titles and descriptions instead of the generic template, so search results should better match what people were actually looking for.

The audio converter got several rounds of attention this week. The size limit is now 25 MB, up from 10 MB, because music-on-hold source tracks routinely exceed the old limit and nginx's raw 413 page was taking over just above the cutoff instead of the friendly in-app error. There's a new signed-linear 16 kHz output format for people working with wideband codecs. Following a stale conversion link now shows a friendly explanation page instead of a generic 404, since job IDs are shared and bookmarkable but the files themselves get cleaned up after 24 hours. Under the hood, the converter now bounds concurrent sox/ffmpeg subprocesses and caps total outputs per request, so a single request can't monopolize the box.

The vote, flag, and note actions used to include the numeric snippet ID in the URL (/vote/123, /flag/456), which made bot traffic against those paths trivial to write and hard to block cleanly through robots.txt. There are now stable bare-path aliases at /vote, /flag, and /note that take the snippet ID from the form body; the numeric ones still work for backward compatibility. A single robots.txt disallow line now covers both shapes.

iOS was requesting /apple-touch-icon.png about 86 times a month with nothing to serve it, so that's now wired up to the real icon. Chrome and Safari's prefetching proxies check /.well-known/traffic-advice before speculatively loading pages, and the file was missing, so they were conservatively falling back to no prefetch at all. Adding it should make first-navigation feel a little faster for users behind those proxies.

The admin app, only reachable through an SSH tunnel, was still serving responses with no security headers. It now sets X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and a Content-Security-Policy on every response. The public MCP server also got better audit logging: it was recording tool calls but not the surrounding handshake traffic, so "someone connected and walked away" was invisible in the log. The initialize, ping, and tools/list messages are now captured too, distinguishable from real tool calls by a prefix.

An IP that had been running form-probe traffic against /vote and /flag for weeks is now denied at the edge instead of consuming rate-limiter budget on every request.