README: the third route, the public Plugin Studio, and what each route can do

"Where the folder goes" had two routes. The third is the same container with ACCESS=public on a
team's research subdomain: the Plugin Studio open to everyone (following development), its /cdn
built from main serving the site's production maps, and the admin parts behind a password set at
deploy. A small table ranks the three by capability: drop-in (the simplest, no backend),
subdomain (PocketBase behind a sign-in), Plugin Studio (the highest: plugins built live in
public). The two links to the section follow its new name.

The link to deployment/cloud's "Public Studio (ACCESS=public)" section resolves once
repo/public-studio-mode lands, so this lands after it.

README.md

@@ -372,7 +372,7 @@ put it* and *how a page shows it*.
 
 Two questions: **where does the folder go** (hosting), and **how does a page show a map** (embedding).
 
-#### Where the folder goes: two routes
+#### Where the folder goes: three routes
 
 **The easiest path: drop-in.** The folder goes into your own site's `public/`, and your site's own server
 serves every map: one server, no PocketBase, nothing else to run. Set `dropin.dest` in
@@ -396,6 +396,20 @@ saved data, an API for mobile apps), run the dx-maps container on its own subdom
 files in the repo. The `Dockerfile` and `compose.yaml` sit at the repo root; recipe and settings:
 [deployment/cloud/](./deployment/cloud/README.md).
 
+**Plugin Studio: the public Studio, with PocketBase.** The highest route: the same container with
+`ACCESS=public`, on your research subdomain.
+- The Plugin Studio follows `development` and is open to everyone, so what agents land shows up live.
+- Its `/cdn`, built from `main`, serves your site's production maps.
+- Publishing and PocketBase's dashboard ask for a password you set when you deploy; OIDC stays available.
+
+Settings: [the public Studio](./deployment/cloud/README.md#public-studio-accesspublic).
+
+| Route | What runs | Backend | Capability |
+|---|---|---|---|
+| Drop-in | your site's own server serves the folder | none | the simplest, for most sites |
+| Subdomain | the dx-maps container on its own subdomain, behind a sign-in | PocketBase | accounts, saved data, an API |
+| Plugin Studio | the container's public Plugin Studio on your research subdomain; your site embeds maps from its `/cdn` | PocketBase (a password now, OIDC-ready) | the highest: plugins built live in public, plus everything above |
+
 <details>
 <summary><b>More about the folder</b></summary>
 
@@ -692,7 +706,7 @@ bun run dev                     # → open the URL Vite prints: that page is the
 No build needed first — the built maps are already in the repo. To start a plugin, copy
 `plugin-designs/template-bundle/` to `plugin-designs/<your-map>/`; the studio finds it automatically.
 
-To put the maps on your own site, take [the easiest path: drop-in](#where-the-folder-goes-two-routes).
+To put the maps on your own site, take [the easiest path: drop-in](#where-the-folder-goes-three-routes).
 
 <details>
 <summary><b>Make changes to the studio itself</b></summary>
@@ -742,8 +756,8 @@ provider*" page in front of everything, open only to the groups you allow. Recip
 [deployment/cloud/](./deployment/cloud/README.md).
 Working from your own laptop alongside the team (zero config, everything local by default):
 [documentation/HOWTO-join-the-table.md](./documentation/HOWTO-join-the-table.md).
-The two ways dx-maps ships (a drop-in into your own site, or the container on its own subdomain):
-[the two routes](#where-the-folder-goes-two-routes) and [documentation/DEPLOY.md](./documentation/DEPLOY.md).
+The three ways dx-maps ships (a drop-in into your own site, the container on its own subdomain, or the public Plugin Studio):
+[the three routes](#where-the-folder-goes-three-routes) and [documentation/DEPLOY.md](./documentation/DEPLOY.md).
 
 ### Cloud development environment