[feat](web): serve the SPA and web actions on the single listener

Add the browser edge (contract rev 8.2/9): a Preact/Vite SPA under web/,
an embedded placeholder bundle, the /web/* auth and action handlers, and
the explicit browser-action allowlist. The SPA and the API share the one
plaintext :8080 listener; there is no second port and no peer edge, so
main.go also drops the mTLS listener and the identity mounts in the debug
compose fall away. /_manifest announces the web block only while the SPA is
mounted (honesty rule), always with the single service port.

The DSNs move to the shared database's scram-sha-256 credentials, matching
rev 9's removal of the PKI layer.

Committed web/bun.lock because web/package.json and vite.config.ts are new
in this commit. src/web/dist/index.html is a hand-written placeholder, not
a generated bundle: it keeps bare `go build`/`go vet` working from a clean
checkout, while /web/dist (the real build output) stays gitignored.

docker-compose.debug.yaml

@@ -44,12 +44,10 @@ services:
       - go-mod-cache:/go/pkg/mod
       - go-build-cache:/root/.cache/go-build
       - /app/src/tmp # Exclude Air's tmp dir from syncing
-      # mTLS identity for the auth edge: the certs Maestro issued for the dev
-      # fleet (devboot, DCNTRLIZED_DEV=true) at the shared-module default paths,
-      # so the authproxy client authenticates to the mTLS auth hub.
-      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/ca.crt:/dcntrlized/pki/ca.crt:ro
-      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/services/keepnote/tls.crt:/dcntrlized/pki/tls.crt:ro
-      - ${DCNTRLIZED_DATA_DIR:-$HOME/.dcntrlized}/pki/services/keepnote/tls.key:/dcntrlized/pki/tls.key:ro
+      # Browser-edge SPA overlay (contract §10.3): host `bun run build` output is
+      # served without a Go rebuild; falls back to the embedded placeholder when
+      # absent. DCNTRLIZED_WEB_DIR is honoured only in dev/debug mode.
+      - ./web/dist:/web-dist:ro
 
     working_dir: /app/
 
@@ -57,17 +55,26 @@ services:
     environment:
       # DCNTRLIZED_DEV is the single dev selector (registry/auth URLs).
       - DCNTRLIZED_DEV=true
-      # Security theme M2 §2: keep THIS listener plaintext so the RN client
-      # (direct mode) and hot reload work without certs. The auth proxy edge
-      # is still mTLS (mounted identity above).
+      # Contract rev 9: internal traffic is plaintext, so the debug selector no
+      # longer gates any listener — this listener is ALWAYS plaintext now.
       - DCNTRLIZED_DEBUG=true
+      # Browser edge (contract rev 9 §17.2): the SPA and /web/* ride the single
+      # :8080 port, served from the host-built overlay; dev is HTTP so
+      # COOKIE_SECURE=false.
+      - DCNTRLIZED_WEB_ENABLED=true
+      - DCNTRLIZED_WEB_DIR=/web-dist
+      - COOKIE_SECURE=false
+      # Hub base URL for the plaintext internal hop (rev 9: no mTLS identity).
+      # Overridable so a throwaway hub can be exercised without touching the
+      # shared dev stack.
+      - AUTH_SERVICE_URL=${AUTH_SERVICE_URL:-http://dcntrlized-auth:8080}
       # Application configuration
       # - PORT=8080
       # - ENVIRONMENT=development
       # - LOG_LEVEL=debug
 
       # Database connection (shared database on the dcntrlized network)
-      - DATABASE_URL=postgres://postgres:@dcntrlized-db:5432/dcntrlized
+      - DATABASE_URL=postgres://postgres:dcntrlized@dcntrlized-db:5432/dcntrlized?sslmode=disable
 
       # Go specific settings
       - GO111MODULE=on
@@ -102,7 +109,7 @@ services:
       - PGHOST=dcntrlized-db
       - PGPORT=5432
       - PGUSER=postgres
-      - PGPASSWORD=
+      - PGPASSWORD=dcntrlized
       - PGDATABASE=dcntrlized
     command: >
       sh -c 'until pg_isready -h dcntrlized-db -U postgres -d dcntrlized; do sleep 2; done;