feat(api): serve the built Dashboard from the API origin

Serve surfaces/shell's built Dashboard from apps/api on the same origin
as /api (ADR 0044), exactly as the display host is served: a closed set
of files read once at startup, never a static directory, never a path
built from request input.

- The shell exports @ekklesia/shell/dashboard-assets (the exact built
  index.html and script URLs), emits the script at
  assets/ekklesia-dashboard/app.js, and index.html names that absolute
  path so dev and production serve the same URLs.
- GET / and GET /assets/ekklesia-dashboard/app.js answer from a frozen
  snapshot: no-cache with a strong ETag and 304 on match. Source maps
  are never served; every other path is the ordinary sanitized 404.
- The page sets nosniff, X-Frame-Options: DENY, Content-Security-Policy:
  frame-ancestors 'none' (that directive only), and Referrer-Policy:
  no-referrer, on 200 and 304 alike.
- A missing or empty shell build fails startup with a fixed
  DashboardHostAssetError before any module code is imported.
- The If-None-Match comparison moves to conditional-request.ts, shared
  with the display host routes.
- The emailed-link token stripping moves from browser/main.tsx into
  consumeAuthLanding (location and history injected) so it is tested;
  behavior is unchanged.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

surfaces/shell/tests/auth-recovery.test.tsx

@@ -1,7 +1,7 @@
 import { act } from "react";
 import { createRoot, type Root } from "react-dom/client";
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { type HostAuthLanding, readAuthLanding } from "../src/auth-protocol.js";
+import { consumeAuthLanding, type HostAuthLanding, readAuthLanding } from "../src/auth-protocol.js";
 import { HostApp } from "../src/browser/HostApp.js";
 import type { EkklesiaHostConfig } from "../src/host-protocol.js";
 
@@ -140,6 +140,58 @@ async function submit(hostTestId: string): Promise<void> {
   });
 }
 
+describe("consuming an emailed-link landing", () => {
+  it("captures a reset token and strips the whole query from the address bar in place", () => {
+    window.history.replaceState({}, "", "/?ekklesia_auth=reset-password&token=secret-reset-token");
+    const lengthBefore = window.history.length;
+
+    const landing = consumeAuthLanding(window.location, window.history);
+
+    expect(landing).toEqual({ kind: "reset-password", token: "secret-reset-token" });
+    expect(window.location.search).toBe("");
+    expect(window.location.href).not.toContain("secret-reset-token");
+    // Replaced, not pushed: Back cannot return to the entry that held the token.
+    expect(window.history.length).toBe(lengthBefore);
+  });
+
+  it("strips every recognized landing, including a failed verification and an invalid reset link", () => {
+    for (const search of [
+      "?ekklesia_auth=verify-email",
+      "?ekklesia_auth=verify-email&error=TOKEN_EXPIRED",
+      "?ekklesia_auth=reset-password&error=INVALID_TOKEN",
+      "?ekklesia_auth=reset-password&token=not%20a%20valid%20token",
+    ]) {
+      window.history.replaceState({}, "", `/${search}`);
+
+      expect(consumeAuthLanding(window.location, window.history), search).toBeDefined();
+      expect(window.location.search, search).toBe("");
+    }
+  });
+
+  it("leaves an unrelated query untouched and rewrites nothing", () => {
+    window.history.replaceState({}, "", "/?unrelated=1");
+    const replaceState = vi.fn();
+
+    expect(consumeAuthLanding(window.location, { replaceState })).toBeUndefined();
+    expect(replaceState).not.toHaveBeenCalled();
+    expect(window.location.search).toBe("?unrelated=1");
+  });
+
+  it("still returns the captured landing when the browser refuses the rewrite", () => {
+    const replaceState = vi.fn(() => {
+      throw new Error("SecurityError");
+    });
+
+    expect(
+      consumeAuthLanding(
+        { pathname: "/", search: "?ekklesia_auth=reset-password&token=abc123" },
+        { replaceState },
+      ),
+    ).toEqual({ kind: "reset-password", token: "abc123" });
+    expect(replaceState).toHaveBeenCalledWith(null, "", "/");
+  });
+});
+
 describe("emailed-link landing parsing", () => {
   it("recognizes exactly Ekklesia's own two landings", () => {
     expect(readAuthLanding("?ekklesia_auth=verify-email")).toEqual({ kind: "verified" });

surfaces/shell/tests/dashboard-assets.test.ts

@@ -0,0 +1,55 @@
+// @vitest-environment node
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+import { dashboardHostAssetUrls } from "../src/dashboard-assets.js";
+
+const packageDirectory = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+
+describe("Dashboard host asset locator", () => {
+  it("exports only frozen immutable href strings for the two exact built files, never the source map", () => {
+    expect(Object.isFrozen(dashboardHostAssetUrls)).toBe(true);
+    expect(dashboardHostAssetUrls).toEqual({
+      html: new URL("dist/browser/index.html", `file://${packageDirectory}/`).href,
+      script: new URL(
+        "dist/browser/assets/ekklesia-dashboard/app.js",
+        `file://${packageDirectory}/`,
+      ).href,
+    });
+    expect(JSON.stringify(dashboardHostAssetUrls)).not.toContain(".map");
+  });
+
+  it("publishes the locator through a narrow package subpath, not the shell root barrel", async () => {
+    const manifest = JSON.parse(
+      await readFile(path.join(packageDirectory, "package.json"), "utf8"),
+    ) as { exports?: Record<string, unknown> };
+    expect(manifest.exports?.["./dashboard-assets"]).toEqual({
+      import: "./dist/dashboard-assets.js",
+      types: "./dist/dashboard-assets.d.ts",
+    });
+
+    const rootSource = await readFile(path.join(packageDirectory, "src/index.ts"), "utf8");
+    expect(rootSource).not.toContain("dashboardHostAssetUrls");
+    expect(rootSource).not.toContain("dashboard-assets");
+  });
+
+  it("loads exactly one fixed, absolute, same-origin script and no inline script", async () => {
+    const html = await readFile(path.join(packageDirectory, "index.html"), "utf8");
+
+    expect(html).toContain('id="ekklesia-host"');
+    expect(html.match(/<script\b/gu)).toHaveLength(1);
+    expect(html).toContain(
+      '<script src="/assets/ekklesia-dashboard/app.js" type="module"></script>',
+    );
+  });
+
+  it("builds the Dashboard entry at the exact path the locator names", async () => {
+    const buildScript = await readFile(
+      path.join(packageDirectory, "scripts/build-browser.mjs"),
+      "utf8",
+    );
+
+    expect(buildScript).toContain('"assets/ekklesia-dashboard/app": path.join(');
+  });
+});