[FEATURE] - PR9 : Web deploy

[pulk17]

[FEATURE]

In raising this pull request, I confirm the following (please check boxes):

• I have read and understood the contributors guide.
• I have checked that another pull request for this purpose does not exist.
• I have considered, and confirmed that this submission will be valuable to others.
• I accept that this submission may not be used, and the pull request closed at the will of the maintainer.
• I give this submission freely, and claim no ownership to its content.

My familiarity with the project is as follows (check one):

• I have never used the project.
• I have used the project briefly.
• I have used the project extensively, but have not contributed previously.
• I am an active contributor to the project.

---

Serving the console from /app/ on the platform's own domain. Depends on #1203.

What's here

an nginx block serving the static build at /app/, with hashed assets cached hard and an SPA fallback
a step in the existing deploy pipeline that builds the console on the runner and ships only dist/, so the VM needs no Node toolchain
CONSOLE_URL written by install.sh, so recovery emails link to the console
web.yml, which lints, typechecks, builds and audits - and only runs when web/ changes, so it doesn't fire on backend PRs

Same origin as the API is the point: no CORS, no second certificate, and no third party in the path when someone signs in.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud