feat(ui): implement App Launchpad and secure logout redirect
This PR implements the requested App Launchpad feature and secures the logout process against open-redirect attacks.
Key changes:
1. **Logout Return-Path Validation**: Added `isSafeRedirectUrl` and updated the `GET /logout` handler. Unsafe redirects are logged as `open_redirect_intercepted`, while successful logouts generate `logout_success` events on the Merkle ledger. All host and parent wildcard cookies (`getCookieDomain()`) are cleared to prevent state collisions.
2. **SSO Application Launchpad**: Introduced `ui/components/AppLaunchpadPage.tsx` using pure Hono SSR JSX. Updates `GET /dashboard` to render this page as the main authenticated landing view. Query logic uses strict Zero-Knowledge filtering—regular users only see explicitly granted apps, and Global Admins see all apps tagged with an `[Admin]` badge.
3. **Hybrid Ingress Playbook**: Authored `docs/HYBRID_INGRESS_PLAYBOOK.md` detailing the architectural split between Traefik ForwardAuth and client application SSR routing.
4. **Testing & QA**: Written comprehensive hermetic unit tests in `server/main.test.ts` for the redirect interceptor, standard logout logic, and Zero-Knowledge role queries. All tests pass with full quality gate compliance (`deno fmt`, `deno task lint`, `deno task check`).
- Add isSafeRedirectUrl utility to prevent open-redirect vulnerabilities.
- Update GET /logout to handle ?redirect=, clear cookies safely, and log audit events.
- Create AppLaunchpadPage.tsx using pure Hono SSR JSX for application visibility and SSO launching.
- Update GET /dashboard and AuthenticatedLayout.tsx to mount the Launchpad as the default authenticated view with Zero-Knowledge querying.
- Add HYBRID_INGRESS_PLAYBOOK.md documentation for Traefik ForwardAuth routing.
- Implement exhaustive unit tests in server/main.test.ts for redirect preservation, anomaly logging, and Zero-Knowledge role filtering.
Co-authored-by: mrteye <1945243+mrteye@users.noreply.github.com>
