feat(api): serve the built Dashboard from the API origin

Serve surfaces/shell's built Dashboard from apps/api on the same origin
as /api (ADR 0044), exactly as the display host is served: a closed set
of files read once at startup, never a static directory, never a path
built from request input.

- The shell exports @ekklesia/shell/dashboard-assets (the exact built
  index.html and script URLs), emits the script at
  assets/ekklesia-dashboard/app.js, and index.html names that absolute
  path so dev and production serve the same URLs.
- GET / and GET /assets/ekklesia-dashboard/app.js answer from a frozen
  snapshot: no-cache with a strong ETag and 304 on match. Source maps
  are never served; every other path is the ordinary sanitized 404.
- The page sets nosniff, X-Frame-Options: DENY, Content-Security-Policy:
  frame-ancestors 'none' (that directive only), and Referrer-Policy:
  no-referrer, on 200 and 304 alike.
- A missing or empty shell build fails startup with a fixed
  DashboardHostAssetError before any module code is imported.
- The If-None-Match comparison moves to conditional-request.ts, shared
  with the display host routes.
- The emailed-link token stripping moves from browser/main.tsx into
  consumeAuthLanding (location and history injected) so it is tested;
  behavior is unchanged.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

surfaces/shell/tests/dashboard-assets.test.ts

@@ -0,0 +1,55 @@
+// @vitest-environment node
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+import { dashboardHostAssetUrls } from "../src/dashboard-assets.js";
+
+const packageDirectory = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
+
+describe("Dashboard host asset locator", () => {
+  it("exports only frozen immutable href strings for the two exact built files, never the source map", () => {
+    expect(Object.isFrozen(dashboardHostAssetUrls)).toBe(true);
+    expect(dashboardHostAssetUrls).toEqual({
+      html: new URL("dist/browser/index.html", `file://${packageDirectory}/`).href,
+      script: new URL(
+        "dist/browser/assets/ekklesia-dashboard/app.js",
+        `file://${packageDirectory}/`,
+      ).href,
+    });
+    expect(JSON.stringify(dashboardHostAssetUrls)).not.toContain(".map");
+  });
+
+  it("publishes the locator through a narrow package subpath, not the shell root barrel", async () => {
+    const manifest = JSON.parse(
+      await readFile(path.join(packageDirectory, "package.json"), "utf8"),
+    ) as { exports?: Record<string, unknown> };
+    expect(manifest.exports?.["./dashboard-assets"]).toEqual({
+      import: "./dist/dashboard-assets.js",
+      types: "./dist/dashboard-assets.d.ts",
+    });
+
+    const rootSource = await readFile(path.join(packageDirectory, "src/index.ts"), "utf8");
+    expect(rootSource).not.toContain("dashboardHostAssetUrls");
+    expect(rootSource).not.toContain("dashboard-assets");
+  });
+
+  it("loads exactly one fixed, absolute, same-origin script and no inline script", async () => {
+    const html = await readFile(path.join(packageDirectory, "index.html"), "utf8");
+
+    expect(html).toContain('id="ekklesia-host"');
+    expect(html.match(/<script\b/gu)).toHaveLength(1);
+    expect(html).toContain(
+      '<script src="/assets/ekklesia-dashboard/app.js" type="module"></script>',
+    );
+  });
+
+  it("builds the Dashboard entry at the exact path the locator names", async () => {
+    const buildScript = await readFile(
+      path.join(packageDirectory, "scripts/build-browser.mjs"),
+      "utf8",
+    );
+
+    expect(buildScript).toContain('"assets/ekklesia-dashboard/app": path.join(');
+  });
+});