Data out of public/: sources live in data/, the web-root is generated

public/ was confusing because three source-of-truth folders lived ONLY inside it.
They now live in data/ (people-groups, vendor, external-bundles) and the build
copies them into the served tree (same pattern as boundaries), so served paths
are unchanged and public/ is fully regenerable. data/README.md states the law.

data/README.md

@@ -0,0 +1,14 @@
+# data/ — the bundler's source-of-truth data
+
+**The law: data lives here; `public/` is generated.** Every folder in `data/` is copied into the
+served web-root by the build (`internal/generate-tree.mjs`), exactly like the per-profile data in
+`app-profiles/*/data/`. You should be able to `rm -rf public/` and get it all back with `bun run build`.
+
+| Folder | Served at | What it is |
+|---|---|---|
+| `people-groups/` | `/assets/people-groups/` | People-group datasets (CSV/JSON) the maps read at runtime |
+| `vendor/` | `/assets/vendor/` | Third-party runtime assets (e.g. table libraries) |
+| `external-bundles/` | `/external/` | Prebuilt map IIFEs vendored from sibling projects (not built here) |
+
+Don't edit anything under `public/` by hand — change it here (or in `app-profiles/*/data/`,
+`layouts/*/assets/`) and rebuild.

internal/generate-tree.mjs

@@ -768,6 +768,26 @@ function main() {
       [join(dataDir, 'gb-CHN-ADM1.geojson'), 'gb-CHN-ADM1.geojson'],
     ]) if (existsSync(from)) cpSync(from, join(bDir, to))
     console.log('[generate-tree] copied boundary geojson → public/assets/boundaries')
+
+    // DATA LIVES IN data/, THE WEB-ROOT IS GENERATED (the D1 reorganization):
+    // source-of-truth folders that used to sit ONLY inside public/ now live in
+    // data/ and are copied into the served tree here, exactly like boundaries
+    // above. Served paths are unchanged (public/assets/people-groups, /vendor,
+    // /external), so no runtime reference moves. public/ stays fully
+    // regenerable: rm -rf it and `bun run build` rebuilds everything.
+    const repoData = resolve(__dirname, '..', 'data')
+    for (const [srcName, destRel] of [
+      ['people-groups', join(pubAssets, 'people-groups')],
+      ['vendor',        join(pubAssets, 'vendor')],
+      ['external-bundles', resolve(__dirname, '..', 'public', 'external')],
+    ]) {
+      const src = join(repoData, srcName)
+      if (!existsSync(src)) continue
+      rmSync(destRel, { recursive: true, force: true })
+      mkdirSync(destRel, { recursive: true })
+      cpSync(src, destRel, { recursive: true })
+    }
+    console.log('[generate-tree] copied data/ sources → web-root (people-groups, vendor, external)')
   }
 
   for (const dest of dests) {