serve vaultwarden at officer own host, without officer auth

So the bitwarden browser extension can point here and the separate public vaultwarden
hostname can be taken down.

/api/vault cannot serve it: that router requires an officer session and REPLACES the caller
Authorization header with a server-held vaultwarden token. Right for our own clients — the
device then holds no vault credential — and impossible for a third-party client that gets
its own token from /identity/connect/token and has nowhere to put a platform JWT.

So a separate mount rather than a mode of that router: blending them would put an
unauthenticated branch inside the authenticated path. This one forwards Authorization
untouched and rewrites nothing.

Leaving it open is not a new exposure — everything here was already reachable at the
vaultwarden URL it replaces, behind the same master password, and officer cannot add a check
it has no credential for. It is also going behind tailscale.

Temporary. The end state is our own extension reusing @officer/vault, which already runs as
a plain JS bundle outside react native (the iOS autofill extension hosts it in
JavaScriptCore), against the /api/vault/session/login broker — then nothing addresses
vaultwarden directly and this mount is deleted rather than adjusted.

Needed its own entry in server.tsx: only listed paths reach hono and the rest fall through
to the SPA, so without it the endpoint answered 200 with the react shell — a missing route
that looks like a working one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/servers/hono.ts

@@ -23,6 +23,7 @@ import { taskLogsRouter } from './api/task-logs/task-logs';
 import { router as fileBrowserRouter } from './api/file-browser/router';
 import { musicRouter } from './api/music/router';
 import { vaultRouter } from './api/vault/router';
+import { publicVaultRouter } from './api/vault/public-router';
 import { agentHandoffRouter } from './api/agent-handoff/router';
 import { slskdRouter } from './api/slskd/router';
 import { headscaleRouter } from './api/headscale/router';
@@ -103,6 +104,14 @@ honoServer.route('/api/waitlist', waitlistRouter);
 // gating still applies via originScopeMiddleware above (OFFICER_VAULT_ORIGIN → /api/vault). The
 // notifications WebSocket is upgraded at the serve level (server.tsx).
 honoServer.route('/api/vault', vaultRouter);
+
+// The same Vaultwarden, with NO Officer authentication, so the Bitwarden browser extension can point at
+// this host instead of at a second public hostname for Vaultwarden. Deliberately its own mount rather
+// than a mode of the router above: that one requires an Officer session and swaps the caller's
+// Authorization header for a server-held token, and blending the two would put an unauthenticated branch
+// inside the authenticated path. Temporary — see public-router.ts for what replaces it and why leaving it
+// open is not a new exposure.
+honoServer.route('/vaultwarden', publicVaultRouter);
 honoServer.get('/api/integrations/google/callback', googleCallbackHandler);
 
 // Agent-to-agent handoff — mounted TOP-LEVEL for the same reason the vault is: the caller is a Claude