feat(server): serve dashboard SPA with deep-link fallback; remove v1 portal

Axum now serves the v2 React/Vite dashboard SPA at / with a client-side
routing fallback, and the dead v1 HTML portal is removed (nothing was
live on the server to preserve).

- SPA served from server/static/app via ServeDir with a fallback to
  index.html, so deep links (/machines, /sessions) resolve to the SPA.
- /api/*rest and /ws/*rest return JSON 404 so unrouted API/WS paths never
  leak index.html to clients; real /api, /ws, /health, /metrics, and the
  /downloads nest keep precedence (matchit static-over-wildcard).
- Path-aware Cache-Control: hashed /assets immutable, index.html no-cache.
- Vite builds to server/static/app (base /); the artifact is gitignored
  and rebuilt at deploy time (npm ci && npm run build).
- Removed v1 portal files (login/dashboard/users/index/viewer .html) and
  their dead serve_* handlers; the SPA owns /, /login, /dashboard, /users.

Verified locally: server boots, / and deep links serve the SPA, unknown
/api path returns JSON 404 (not HTML), /health and /downloads intact.
cargo build + clippy -D warnings green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

dashboard/vite.config.ts

@@ -5,14 +5,23 @@ import react from "@vitejs/plugin-react";
 // forwarded to the Rust server on :3002 so `npm run dev` works against a real
 // backend without CORS gymnastics.
 //
-// `base` is "./" so the built assets reference relative paths — production
-// serving copies `dist/` into the server's static dir and a catch-all route
-// serves index.html. Wiring that catch-all in the Rust server is a DEPLOY
-// concern (see README), not done in this pass.
+// PRODUCTION SERVING (wired in the GC server):
+//   - `base` is "/" (absolute asset paths). The SPA is served from the server
+//     root and uses `BrowserRouter`, so a hard reload of a deep link such as
+//     `/machines` must still resolve `/assets/*` correctly. Relative ("./")
+//     asset paths would break here: the browser would resolve them against the
+//     deep-link path (`/machines/assets/...`) and 404. Absolute "/" is required.
+//   - `build.outDir` points straight into the server's static tree at
+//     `server/static/app/`, so `npm run build` lands the SPA exactly where the
+//     Axum `fallback_service` serves it — no manual copy step at deploy time.
+//   - `emptyOutDir` is true, which is SAFE because the target is the dedicated
+//     `app/` SUBDIR. It wipes only `server/static/app/`, never the static root,
+//     so the v1 portal files (login.html, dashboard.html, viewer.html,
+//     downloads/) are untouched.
 const GC_SERVER = "http://localhost:3002";
 
 export default defineConfig({
-  base: "./",
+  base: "/",
   plugins: [react()],
   server: {
     port: 5273,
@@ -29,7 +38,11 @@ export default defineConfig({
     },
   },
   build: {
-    outDir: "dist",
+    // Emit directly into the server's static tree. The Axum server serves this
+    // directory as its SPA fallback (see server/src/main.rs). Dedicated subdir,
+    // so emptyOutDir only clears the SPA build — not the v1 portal files.
+    outDir: "../server/static/app",
+    emptyOutDir: true,
     sourcemap: true,
   },
 });