feat(web): serve the CLI login flow from the apex

[ralyodio]

logicsrc login defaults to https://logicsrc.com (#104) — but every path it needs 404s
there. The apex runs the marketing app; /cli/* lives in apps/pwa on a separate service.

This fixes it with no DNS record, no subdomain, and no Railway custom domain. The app
that owns the apex proxies those paths, exactly as it already proxies CommandBoard.

Pointing the apex at the pwa was the obvious alternative and is wrong: the pwa serves /
too, so it would take the marketing site down with it.

Proxied

path	why
/cli/:path*	the device-code + loopback login flows
/api/me	identity
/api/credshare/:path*	the credential-sharing API used after login
/auth/:path*	/cli/authorize and /cli/device are behind requireAuth, so an unauthenticated visitor gets redirected here — without it the browser half of login dead-ends on a 404

Ordering is the subtle part

CommandBoard owns a catch-all /api/:path*. Anything of the credentials app's under
/api must match first, or CLI auth silently goes to the wrong service. Verified:

0 /cli/:path*            4 /health
1 /api/me                5 /api/:path*      <- catch-all, last
2 /api/credshare/:path*
3 /auth/:path*

Verified

Rewrite construction is factored into pure functions so ordering is testable without
booting Next. All checks pass, including that with CREDENTIALS_APP_URL unset the output
is byte-identical to what ships today — this is additive, not a behaviour change for
the existing deployment.

A vitest contract test is included; it couldn't be executed here (no node_modules in the
environment), so the logic was verified by loading the config directly under Node.

Deploy

Set CREDENTIALS_APP_URL on the logicsrc-web service to the credentials app's origin.
Until that's set, nothing changes.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.