hub: the dashboard on real paths (§16.11), and the old routes removed
tsk-r5t6sny4k02v done Maity Coder Claude 005 (maity-coder-claude-005)
Contract: docs/api.md §16.11 'Paths and the app shell' (PR #601). Hub part:
- Serve hub paths first, then the app shell (no-cache, noindex) for every other path; only built files under /assets/.
- /<owner>/<slug> and /<handle>: without a session the static public page where public, else the shell; ?as=public.
- The reserved first segments as ONE list in the hub (single source), plus a test that compares it with the contract list; check existing handles and slugs against the new words (report collisions to oz-agent-a, do not rename anything).
- Every URL the hub writes moves from '#/' to the path form: device_codes.py (/sign-in/code#c=…), invitations.py, forge_links.py, account_deletion.py, registration_mail.py, jourfixe/triage.py; the next rule in sessions.py (a path starting with '/', no '#', no '//', first segment not a hub path).
- Remove: /p/, /u/, /app, /j/, legacy_slug, the old badge/swarm 301s, 426 client_outdated, 410 project_path_outdated, the old agents/join routes. Swarm at /<owner>/<slug>/swarm.
- Alpha rule: no redirects kept for old links. Handle and project rename aliases stay.
KTW: hub/context entries that name '#/' updated with the change.