Add Compass real-estate mirror (port 40015)

[sarendis56]

TL;DR

Adds a Flask mirror of compass.com as the 16th
WebHarbor site, with browse / search / filter, listing detail, agent
directory, account flows (save, tour, inquiry, saved search, collection),
and 18 WebVoyager-format benchmark tasks.

Companion HuggingFace PR: https://huggingface.co/datasets/ChilleD/WebHarbor/discussions/3

Note: PRs #11, #12, #24 also claim port 40015. Whichever lands first
keeps it; happy to rebase onto the next free port if this isn't merged
first.

What's in this PR

Site code (sites/compass/)

File	Lines	Purpose
app.py	1,011	Flask app: 10 SQLAlchemy models, 35+ routes, token-overlap scored search
seed_data.py	659	Idempotent seed (524 listings, 20 agents, 10 cities, 4 benchmark users)
templates/*.html	33 files	base + 32 page templates, hand-rolled Compass look
static/css/compass.css	327	White / black / serif palette matching the real site
listings_clean.json	524 records	Normalized scrape output consumed by seed_data.py at build time
tasks.jsonl	18	WebVoyager benchmark tasks (3 hard multi-step)
_health.py	—	End-to-end health probe
requirements.txt	—	Pinned to image's Flask / SQLAlchemy versions

Registration (3 files modified, must stay in sync per AGENTS.md)

• websyn_start.sh — compass appended to SITES=( … ), the two 15s
  in ready-count log lines bumped to 16.
• control_server.py — 'compass' appended to SITES.
• Dockerfile — EXPOSE 8101 40000-40015.

Verification

All checks in AGENTS.md § Pre-PR checks pass.

• python3 -m py_compile sites/compass/{app.py,seed_data.py} — clean.
• ./scripts/build.sh webharbor:dev — image builds.
• docker run on alt ports 8201 / 41000-41015:
  • /health reports all 16 sites alive with PIDs.
  • All 16 root paths return 200.
• Byte-identical reset (the strict invariant):

  curl -X POST :8201/reset/compass
  md5sum instance/compass.db instance_seed/compass.db
  # 2a7458e3b6c3e3d0b39c32cca5d0f519  both files
  

• All 18 tasks in tasks.jsonl walk end-to-end against the running mirror.

Design notes

• Determinism. Passwords use PBKDF2 with a fixed per-email salt
  (`sha1("salt-" + email)[:8]`), not bcrypt, because bcrypt's random salt
  breaks byte-identical reset. `User.check_password` accepts both prefixes
  so future writes from the running app (which uses Flask-Bcrypt) still
  authenticate.
• Search scoring. Token-overlap with city / state / neighborhood boosts
  rather than strict `LIKE %q% AND %q%` — matches the booking-site pattern
  in `sites/booking/app.py`.
• No task-info leaks. Homepage panels (Newest, Luxury) sort by
  `Listing.id` rather than `price.desc()` so the answers to Tasks 11 / 17
  don't surface for free in the hero grid. Co-op pool was backfilled to

  = 5 candidates per filter combo used in tasks.

• Real assets. All listing photos are the actual
  `compass.com/m/0//600x400.webp` images, resolved via Playwright
  and downloaded with httpx. No placeholders, no AI stock photos.

Assets

Heavy assets (`instance_seed/compass.db`, `static/images/`, ~129 MB
packed) ship via the companion HuggingFace PR linked above.
`.assets-revision` already pins `main`, so once the HF PR merges this
code PR Just Works.