refactor(val): rename walkthrough → tour in prose, emails, and comments

Finishes the walkthrough → tour rename that started with scripts
and configs. Val Town backend catches up:

- Email subject line (auth-request.ts): "Your Socket walkthrough
  login code" → "Your Socket tour login code"
- Email HTML body (email-template.ts): h1 headline, instruction
  paragraph, mailto subject — all reference "tour"
- Plain-text email body: matches the HTML version
- Source-code comments + file headers (index.ts, comments-read.ts,
  comments-mutate.ts, email-template.ts) now say "tour"
- Shell script (integration-test.sh) usage notes point at
  `pnpm tour:valtown` instead of the old `pnpm walkthrough deploy-val`

Intentionally NOT renamed — external identifiers that would churn
real accounts or rotation cycles:

- config.ts:51 `email: 'socketdev.walkthrough@valtown.email'` —
  external email address
- integration-test.sh:6 `jdalton-socket-walkthroughs.web.val.run` —
  external Val Town URL

Those stay on the walkthrough handle. Users with already-delivered
emails see old subject lines; new deliveries match the new brand.

All 47 val tests pass; pnpm type + pnpm lint + pnpm check green.

Author: jdalton

val/auth-request.ts

@@ -77,7 +77,7 @@ export const registerAuthRequest = (app: Hono<AppEnv>): void => {
           to: rawEmail,
           from: EMAIL_FROM,
           replyTo: EMAIL_REPLY_TO,
-          subject: 'Your Socket walkthrough login code',
+          subject: 'Your Socket tour login code',
           html: renderLoginEmail(code),
           text: renderLoginEmailText(code),
         })

val/comments-mutate.ts

@@ -39,7 +39,7 @@ export const registerCommentMutateRoutes = (
     }
     // Load the row first so we can confirm it exists AND that the
     // requester owns it. 404 vs 403 is deliberate: leaking "this id
-    // exists but you can't touch it" is fine for a walkthrough — it
+    // exists but you can't touch it" is fine for a tour — it
     // doesn't expose anything sensitive about the comment contents.
     const existing = await sqlite.execute({
       sql: 'SELECT author FROM comments WHERE id = :id AND slug = :slug',

val/comments-read.ts

@@ -4,7 +4,7 @@
  * All three are read-only queries against the comments table, so they
  * share a file. Each requires auth (no anonymous browsing) but none
  * enforce author-only filters — any authed user can see every comment
- * on the walkthrough.
+ * on the tour.
  */
 
 import type { Context, Hono, Next } from 'npm:hono@4.12.14'
@@ -38,7 +38,7 @@ export const registerCommentReadRoutes = (
 
   // Dump all (or unresolved-only) comments as a JSON bundle for
   // offline archival / review. Single round-trip, no pagination —
-  // walkthroughs are small enough that the full list is fine.
+  // tours are small enough that the full list is fine.
   app.get('/:slug/api/comments/export', requireAuth, async c => {
     await ensureDb
     const slug = c.req.param('slug')
@@ -57,7 +57,7 @@ export const registerCommentReadRoutes = (
     })
   })
 
-  // List comments for a single walkthrough part. Part ID capped so a
+  // List comments for a single tour part. Part ID capped so a
   // malformed query string can't produce an inefficient index scan.
   app.get('/:slug/api/comments', requireAuth, async c => {
     await ensureDb

val/email-template.ts

@@ -9,7 +9,7 @@
  *   - Logo uses HTTPS image hosted at socket.dev (public CDN)
  *
  * Copy intentionally does NOT say "sign in to socket.dev" because the
- * code grants access to a walkthrough viewer, not socket.dev itself.
+ * code grants access to a tour viewer, not socket.dev itself.
  * Disclaimer links to security@socket.dev so unexpected codes surface
  * as real security signal, not noise to ignore.
  */
@@ -29,17 +29,17 @@ export const renderLoginEmail = (code: string): string => {
     <div style="text-align:center;margin-bottom:24px;">
       <img src="https://socket.dev/images/logo-280x80.png" alt="Socket" width="140" height="40" style="display:inline-block;" />
     </div>
-    <h1 style="margin:0 0 8px 0;font-size:24px;font-weight:600;color:#1a1a1a;text-align:center;">Your Socket walkthrough login code</h1>
-    <p style="margin:0 0 24px 0;font-size:15px;line-height:1.5;color:#57606a;text-align:center;">Enter this code in the walkthrough to sign in. It expires in 10 minutes.</p>
+    <h1 style="margin:0 0 8px 0;font-size:24px;font-weight:600;color:#1a1a1a;text-align:center;">Your Socket tour login code</h1>
+    <p style="margin:0 0 24px 0;font-size:15px;line-height:1.5;color:#57606a;text-align:center;">Enter this code in the tour to sign in. It expires in 10 minutes.</p>
     <div style="margin:28px 0;padding:20px;background:#f5f6f8;border-radius:8px;text-align:center;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;font-size:34px;font-weight:700;letter-spacing:0.06em;color:#1a1a1a;">
       ${digits}
     </div>
-    <p style="margin:24px 0 0 0;font-size:13px;line-height:1.5;color:#8b949e;text-align:center;">Didn't request this code? Please report it to <a href="mailto:security@socket.dev?subject=Unrequested%20walkthrough%20login%20code" style="color:#0969da;text-decoration:underline;">security@socket.dev</a>.</p>
+    <p style="margin:24px 0 0 0;font-size:13px;line-height:1.5;color:#8b949e;text-align:center;">Didn't request this code? Please report it to <a href="mailto:security@socket.dev?subject=Unrequested%20tour%20login%20code" style="color:#0969da;text-decoration:underline;">security@socket.dev</a>.</p>
   </div>
 </body>
 </html>`
 }
 
 export const renderLoginEmailText = (code: string): string =>
-  `Your Socket walkthrough login code is ${code}. It expires in 10 minutes.\n\n` +
+  `Your Socket tour login code is ${code}. It expires in 10 minutes.\n\n` +
   `Didn't request this code? Please report it to security@socket.dev.`

val/index.ts

@@ -1,5 +1,5 @@
 /**
- * @fileoverview Socket walkthrough comment backend — HTTP entry point.
+ * @fileoverview Socket tour comment backend — HTTP entry point.
  *
  * Composes modules:
  *   config          — env vars + constants

val/integration-test.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Live integration tests for the Socket walkthrough comment val.
+# Live integration tests for the Socket tour comment val.
 # Runs against a deployed Val Town URL. Does NOT require Deno or Node.
 #
 # Usage:
@@ -12,7 +12,7 @@
 #   - SQLite persistence
 #   - Email sending (manual step — check inbox)
 #
-# Run after `pnpm walkthrough deploy-val` + secret config. Expected env
+# Run after `pnpm tour:valtown` + secret config. Expected env
 # vars:
 #   VAL_URL                  URL of deployed val
 #   TEST_EMAIL               a @socket.dev address you control