Independent review Not signed off — 0 high, 1 medium, 1 low (#4)
Add internal/frontend, which embeds internal/frontend/dist and serves it with Cache-Control "no-cache" for index.html, sw.js and manifest.webmanifest and "public, max-age=31536000, immutable" for every other asset. Any other GET or HEAD falls back to index.html, except paths under the reserved /api, /auth, /media and /health prefixes, which get the JSON not_found error instead. NewRouter now takes the asset fs.FS so tests use a fstest.MapFS fixture, mounts an /api subrouter with JSON 404/405 handlers, and fails fast if the assets lack index.html. A placeholder dist/index.html is tracked so a fresh clone compiles; built assets remain git-ignored. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>