plugins: let a plugin claim top-level paths and divert /api by header

Restores the setup the vault extraction regressed: paste the bare Officer URL
into a Bitwarden client and log in. Nothing else.

The extraction moved the Bitwarden door to /api/vault/bw, which is correct and
unusable — a client derives /api, /identity, /icons and /notifications from ONE
url it is given, so a prefixed base turns setup into five fields copied by hand
into an advanced pane. That is not a feature anyone completes, and the owner
said so. My regression, my wrong call: I treated "a plugin cannot serve
top-level paths" as a fact about the platform when it was a fact about what had
been built.

Two additions, both manifest-declared, both narrow:

  unauthenticatedRootPaths  single lowercase segments (`/identity`), served
                            above the gate. Refused if reserved (`/api`,
                            `/auth`, `/plugins`, `/dav`, …), refused if another
                            plugin already claims it, refused if it is anything
                            more structural than one name.

  protocolHeaders           hands `/api/*` to the plugin when the request
                            carries one. Needed because /api is the one
                            namespace both servers claim — Vaultwarden has
                            /api/sync, Officer has /api/chat — and the path
                            cannot tell them apart, so the client says who it
                            is. ROUTING, not authentication: a forged header
                            reaches the plugin, which demands its own
                            credential, and cannot reach anything of Officer's.
                            The worst it does is cost that caller Officer's API.

The Bun route table gets an entry per claimed segment, built from the plugin
set — `refreshPluginMounts` runs at line ~204, long before serve() at ~378, so
the claims are known. This is the constraint I earlier asserted made the whole
thing impossible, without checking it. The real cost is smaller and stated in
the code: a plugin claiming a root path is not fully installed until
`pm2 restart officer`, because the table is fixed once serve() is called.

Every claim is logged at boot by plugin — a root path answering without a
session should not be something you read a manifest to discover.

13 more tests (30 in the file): reserved segments, malformed segments, two
plugins colliding, and segment-not-substring matching so `/identityx` never
matches `/identity`. Suite 1074 pass / 0 fail.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/server.tsx

@@ -5,6 +5,7 @@ import { join } from 'node:path';
 import { honoServer, PROTECTED_API_PREFIXES, UNPROTECTED_API_PREFIXES } from './servers/hono';
 import { assertPermissionTotality } from './servers/permissions/totality';
 import { refreshPluginMounts, snapshotPlugins } from './servers/plugins/mount';
+import { listPluginRootClaims } from './servers/plugins/public-paths';
 import { generatePluginsModule, rebuildFrontend, BUILD_DIR, SHELL_FILE } from './servers/plugins/generate';
 import { assertInstallLayout } from './servers/data-path';
 import { PORT } from './servers/officer-url.mjs';
@@ -429,6 +430,25 @@ const server = serve({
     // '/.well-known/carddav': honoServer.fetch,
     // '/dav': honoServer.fetch,
     // '/dav/*': honoServer.fetch,
+    /*
+      Top-level paths a plugin claims (`/identity/*`, …), handed to hono BEFORE the SPA fallback.
+
+      They need naming here for the same reason `/dav` did: Bun matches this table first, and only the
+      paths listed reach hono — anything else falls through to `/*`, which answers 200 with the React
+      shell. A missing entry therefore looks like a working endpoint returning nonsense rather than a 404,
+      which is among the least debuggable failures available.
+
+      Built from the plugin set because `refreshPluginMounts` has already run by here (line ~204, well
+      before `serve()`), so the claims are known. The cost is that adding or removing one needs a restart —
+      this table is fixed once `serve()` is called. Stated rather than worked around: installing a plugin
+      that claims a root path is the one install that is not complete until `pm2 restart officer`.
+    */
+    ...Object.fromEntries(
+      listPluginRootClaims().flatMap(({ segment }) => [
+        [`/${segment}`, (req: Request, server: unknown) => honoServer.fetch(req, server)],
+        [`/${segment}/*`, (req: Request, server: unknown) => honoServer.fetch(req, server)],
+      ]),
+    ),
     ...spaRoutes,
     '/api': honoServer.fetch,
     // A CLOSURE, deliberately, and not the bound `honoServer.fetch`.