feat: add browser auth shell

surfaces/shell/tests/modularity.test.ts

@@ -149,11 +149,21 @@ describe("the shell builds no module knowledge into its bundle", () => {
     // time from the navigation the server resolved.
     expect(bundle).toContain('"/api/v1/principal"');
     expect(bundle).toContain('"/api/v1/dashboard/navigation"');
+    expect(bundle).toContain('"/api/auth/sign-in/email"');
+    expect(bundle).toContain('"/api/auth/sign-out"');
     // The shell reads the navigation view, which already contains the inventory; it never calls
     // the host-neutral inventory endpoint itself.
     expect(bundle).not.toContain('"/api/v1/module-ui"');
   });
 
+  it("contains only the browser HTTP auth adapter, never Better Auth or server identity internals", () => {
+    expect(bundle.toLowerCase()).not.toContain("better-auth");
+    expect(bundle.toLowerCase()).not.toContain("drizzle");
+    expect(bundle).not.toContain("EKKLESIA_IDENTITY_SECRET");
+    expect(bundle).not.toContain("bootstrapPlatformOwner");
+    expect(bundle).not.toContain("session_token");
+  });
+
   it("bakes in no group, label, or placement", () => {
     // Grouping is server-resolved configuration. A group id or label appearing in the bundle would
     // mean the shell had an opinion about an arrangement it must only render.
@@ -208,6 +218,8 @@ describe("the display host is a separate generic browser bundle", () => {
     expect(bundle).toContain('"/api/v1/principal"');
     expect(bundle).toContain('"/api/v1/module-displays"');
     expect(bundle).not.toContain('"/api/v1/dashboard/navigation"');
+    expect(bundle).not.toContain('"/api/auth/sign-in/email"');
+    expect(bundle).not.toContain('"/api/auth/sign-out"');
     expect(bundle).not.toContain("Loading Ekklesia");
     expect(bundle).not.toContain("Sign in to Ekklesia");
     expect(bundle.toLowerCase()).not.toContain("socket.io");