feat(GAT-9016): land the server shell, landing page and API docs

[calmacx]

What

Replaces the minimal app/root.tsx stub from #132 with the real server shell, and lands RouteError.tsx, routes/home.tsx, routes/docs.tsx and their two routes.ts entries. The shell turns on the root middleware — five security headers plus a MAX_BODY_MB request-body limit, both requiring future.v8_middleware — and a loader that starts the schema reloader as an idempotent lazy singleton. Also corrects the MAX_BODY_MB default from 512 to 10.

Why

This is the last unported piece of src/app.js: Express ran helmet() and express.json({limit:'10mb'}) on every request (src/app.js:38-41) and served Swagger UI at /docs (src/app.js:95). With those ported, WS1's three deliverables — migrate off Express, prove parity, ship the docs — are complete. The PR 2 stub existed only so react-router build could succeed while the lib and API layers stacked.

Testing

Verified against a production build (npm run build && npm start), not dev. Full suite green: 62 passed across 10 files, up from 58 — two from the restored app.test.ts, two from the new security-header cases. npm run typecheck, npm run lint and npm run build all exit 0, and build/openapi.json carries 10 paths.

All five security headers confirmed present on /list/schemas with the expected values. MAX_BODY_MB boundary confirmed: an 11 MB body returns 413, a 9 MB body does not. [schema] loadSchemas() starting appears exactly once across repeated requests, so the loader's singleton holds. No [retention] output, confirming the sweeper is genuinely absent rather than silently starting. grep -rl "jwt-decode\|@google-cloud/pubsub\|GATEWAY_API_URL" build/client/ is empty, so nothing server-only leaked into the client bundle. GET / 200, GET /docs 200 rendering Swagger UI, GET /no-such-route 404.

Notes

• root.tsx is not a byte-identical port and should not be reviewed as one. Vite statically resolves literal-string await import(), so keeping the auth.server and retention.server imports would force this workstream to carry the whole admin lib layer just to satisfy the build. The auth decode, the retention start, the Avatar/role gating and the nav entries for /playground, /schema-graph, /schema-view, /results and /benchmark are all trimmed out and land in WS4 PR01 with the features that need them. git diff poc/GAT-XXXX -- app/root.tsx reads the delta directly: removals plus the nav-array edit, no added logic.
• MAX_BODY_MB 512 to 10 is a deliberate behaviour change, in the safe direction. src/app.js:40 is express.json({limit:'10mb'}); the documented 512 never matched the running service and would have accepted bodies 51x larger than production has ever seen.
• The security-headers block is appended to tests/regressions.test.ts rather than restored from the POC copy — test(GAT-9592): port Vitest suites and add the production regression replay harness #130 made four real parity fixes to that file and taking the POC version wholesale would have reverted them. It now asserts all five headers rather than the POC's two, and covers the HTML route as well as the API one.
• docs.tsx exports no meta(), so /docs has no <title>. That is POC behaviour, left as-is rather than widened here; worth a follow-up.
• The build emits INEFFECTIVE_DYNAMIC_IMPORT for schema.server.ts — root.tsx imports it dynamically but six API routes import it statically, so it cannot be split into its own chunk. Benign, but it means the await import() defers only the call, not the module load.
• No auth anywhere in this PR. Express had none, and no WS1 route calls requireAuth or requireAdmin. JWT_SECRET provisioning is a WS4 PR01 precondition, not a cutover blocker.

🤖 Generated with Claude Code

[gh-actions-pipelines-app]

🎉 Great job! Your PR title follows the correct format. 🚀