kiosk: the authenticated API and two panels

what the mobile app needs is now buildable against something real: GET /apps,
GET /key, GET /install/:app/:platform/:version, POST /installs, plus device and
build verbs. all under /api/kiosk, all behind a platform session.

the install URL is built per request and never stored, because it carries the
CALLING user's key - two people asking for the same build get different links,
which is the point: the artefact route is public and the key is what authorises
it.

deliberately NOT here: the four requests that arrive with no session. installd
fetching the manifest and the ipa, the device posting its udid, safari
downloading a mobileconfig. a plugin cannot serve an unauthenticated route
today, so those wait for the platform primitive and will land in api/public.ts
- a separate file so the two surfaces cannot be confused by whoever reads
either one.

so /install returns a correct URL pointing at a route that does not exist yet.
that is the shape the app should build against.

layout is a horizontal root with the app list first, and that is load-bearing:
on a phone WorkspaceRenderer collapses horizontal groups to children[0] and
PluginScreen passes no mobilePanelId, so first is the only panel a phone shows.
the install page is the one page that must work in mobile safari.

PUBLIC_URL is read from the environment rather than officer-url.mjs, which
exports only loopback URLs - ios is not on loopback, and it needs https with a
cert it already trusts or it declines silently.

web/layout.ts

@@ -0,0 +1,21 @@
+import type { LayoutNode } from 'officerdev';
+
+/*
+  Horizontal root, app list first — and that is load-bearing rather than aesthetic.
+
+  On a phone, `WorkspaceRenderer` collapses a HORIZONTAL group to one child at a time and defaults to
+  `children[0]`. A vertical group is not collapsed at all: every panel stacks into the viewport. And
+  `PluginScreen` passes no `mobilePanelId`, so whatever is first is the only panel a phone will ever show.
+
+  That matters more here than anywhere else in the platform, because the install page is the one page that
+  MUST work in mobile Safari — you cannot install the Kiosk app from the Kiosk app.
+*/
+export const defaultLayout: LayoutNode = {
+  type: 'group',
+  id: 'kiosk-root',
+  direction: 'horizontal',
+  children: [
+    { node: { type: 'panel', id: 'kiosk-apps', appType: 'kiosk-apps' }, size: 55 },
+    { node: { type: 'panel', id: 'kiosk-devices', appType: 'kiosk-devices' }, size: 45 },
+  ],
+};