Dedicate the project page to the project: hero, tabs, screenshots, sidebar

The project detail page becomes a full project showcase on the site's
content measure. The hero card opens with a cover banner from the
project's first image attachment (brand-gradient band as fallback),
then title + status chip, type/platform chips, dates and forked-from
meta, the author row with an owner-set Visit Website CTA, and the
unchanged action row. A sticky anchor tab bar (Overview, Devlog,
Screenshots when images exist, Comments, Files) navigates the page
with plain server-rendered anchors so crawlers index one complete
document. The two-column body keeps About (description + non-image
attachments), the Devlog timeline and the comment thread in the main
column, adds a Screenshots gallery built from image attachments
(lightbox-wired thumbnails), and a sidebar with Links (website, files,
fork source), the Stats card with a last-update line, and the Author
card.

New optional projects.website_url rides the whole stack: normalized
and validated in models (scheme-less input gets https://, non-http(s)
rejected), settable in the create and edit modals, on ProjectOut, in
the Devii create/edit actions and the API docs, rendered as the hero
CTA and Links entry with rel noopener nofollow, and emitted as
schema.org sameAs. The app schema also gains screenshot urls from the
image attachments. The e2e project comment/files tests scope their
locators (.comment-form textarea, .project-detail-actions a) per the
documented dual-control idiom - the composer modal made the bare
selectors ambiguous - and new unit/api tests cover URL normalization,
sameAs/screenshot schema output, the cover, and the gallery.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/unit/models.py

@@ -47,6 +47,23 @@ def test_isslop_run_form_normalizes_typos_and_bare_domains():
     assert IsslopRunForm(url="http:/x.dev/a").url == "http://x.dev/a"
 
 
+def test_project_form_website_url_normalizes_and_validates():
+    from devplacepy.models import ProjectForm, normalize_website_url
+
+    base = {"title": "T", "description": "D"}
+    assert ProjectForm(**base).website_url == ""
+    assert ProjectForm(**base, website_url="myproject.dev").website_url == "https://myproject.dev"
+    assert (
+        ProjectForm(**base, website_url="http://x.dev/a?b=1").website_url
+        == "http://x.dev/a?b=1"
+    )
+    assert normalize_website_url("  ") == ""
+    with pytest.raises(ValidationError):
+        ProjectForm(**base, website_url="javascript:alert(1)")
+    with pytest.raises(ValidationError):
+        ProjectForm(**base, website_url="not a url")
+
+
 def test_reaction_form_accepts_any_single_emoji():
     from devplacepy.models import ReactionForm
 

tests/unit/seo.py

@@ -93,6 +93,28 @@ def test_software_application_schema_rating_and_image():
     assert rich["interactionStatistic"]["userInteractionCount"] == 3
 
 
+def test_software_application_schema_website_and_screenshots():
+    project = {
+        "uid": "p1",
+        "slug": "p1-s",
+        "title": "S",
+        "project_type": "software",
+        "website_url": "https://myproject.dev",
+    }
+    schema = seo.software_application_schema(
+        project,
+        "https://x.test",
+        screenshot_urls=["https://x.test/a.png", "https://x.test/b.png"],
+    )
+    assert schema["sameAs"] == ["https://myproject.dev"]
+    assert schema["screenshot"] == ["https://x.test/a.png", "https://x.test/b.png"]
+    bare = seo.software_application_schema(
+        {"uid": "p2", "slug": "p2-s", "title": "B"}, "https://x.test"
+    )
+    assert "sameAs" not in bare
+    assert "screenshot" not in bare
+
+
 def test_project_devlog_schema_builds_blog_graph():
     project = {"uid": "p1", "slug": "p1-s", "title": "Nebula"}
     assert seo.project_devlog_schema(project, [], "https://x.test") is None