auth: add standalone hosted sign-in application and Pages delivery

[AnthonyRonning]

Native V2 browser sign-in needs its own application and publication lifecycle before traffic can move to auth.trymaple.ai. This adds apps/maple-auth with its own package, frozen lockfile, published SDK 4.1.1 pin, assets, configuration, tests, static build, and independent Pages publisher.

Research is unchanged. The complete apps/maple-research tree and its existing CI environment helper match base afd4987b. Research retains SDK 4.0.1, built-in web sign-in/signup, callbacks, Apple behavior, legacy bridge, browser sessions, and native entry URLs. The auth split requires no Research release. Research's later move to app.trymaple.ai and native direct-entry configuration are separate changes.

Application and publication boundaries

• Auth serves V2-only /start and the permanent /desktop-auth alias, Google/GitHub callbacks, popup-only Apple, account confirmation, native grant mint/open, and completion/recovery pages. It waits for SDK bootstrap and selects callbacks on its own origin.
• Browser credentials persist. Existing account/revision/flow checks, cancellation, expiry, single mint, and manual opening remain; no SDK cleanup API or automatic logout is introduced.
• The published SDK supplies the protocol. Small UI/helper/config copies belong to Auth and retain their tests; provenance and maintenance responsibilities are documented. The bundle guard rejects Research/sibling source, parent dependency trees, linked SDK source, and the legacy SDK.
• Auth CI installs/tests/builds only Auth. Auth-only edits skip Research packaging and Agent checks. Shared CI infrastructure edits can still select their affected lanes.
• Manual production build and publication have their own default-disabled activation flag, protected environment, Pages project, production ref, and artifact identity. Publication checks exact current-master provenance and fixed destination, verifies static asset hashes, then injects trusted headers. App releases cannot publish Auth.

Validation

• Auth's canonical checks passed under the pinned Nix shell: formatting, lint, TypeScript, and 60 top-level Bun tests, including wrappers requiring 32 UI cases and four real-SDK bootstrap scenarios.
• Normal pre-commit checks passed, including the unchanged Research app with SDK 4.0.1: 1,004 tests, zero failures; lint retains 13 existing warnings.
• All 319 repository Python tests passed, including 106 Pages tests; workflow lint and nix flake check --no-update-lock-file passed on aarch64-darwin.
• Both Auth profiles built successfully. The production build also passed in a fresh export containing only Auth and CI scripts, with Research and local SDK source absent. Frozen registry install, module boundary, and five-file static artifact validation passed. Production archive SHA-256: 223da77b9b7dcc8ac610c5c1715539edc99876f4032a8c5590c6a4321daf4eec. Vite retains its bundle-size warning.
• Chrome smoke of that production artifact on loopback covered rendered completion/assets, rejected legacy entry, GitHub callback recovery with the address preserved, and Apple popup-only recovery. No real account was used; provider login, retained-session integration, OS deep links, and live edge behavior remain unverified.
• An independent source review confirmed that unchanged Research keeps using the backend default and can recover new native flows by disabling the forward redirect before the app move.

Review and rollout

This remains an unmerged draft. Fable freshly reviewed standalone revision f5739f5a and planning PR #61 at aed4c17, finding no merge blockers. All GitHub checks at that implementation head passed or were skipped. The documentation-only follow-up 9fb68316 adds both browser consumers to the SDK rollout, release preflight, and Auth publication PCR review. Check combined app-provided/pinned-SDK trust coverage when remote history is unavailable; no byte-parity test or coupled release is required. Runtime, configuration, and workflow code are unchanged from the reviewed head.

Backend foundation #978 and SDK support #979/#987 are merged; TypeScript SDK 4.1.1 and Rust SDK 4.0.2 are published. Only the new Auth consumer adopts 4.1.1 here. Backend deployment, provider registration, exact Auth callback allowlist entries while preserving existing defaults, publisher prerequisites, dark publication, real-provider/native rehearsal, live headers/cache, recovery drills, and finally V2-only edge activation remain staged operations. No production configuration, deployment, redirect, merge, or release is performed by this PR update.

[github-actions]

Maple development preview: https://11a0f0b4.maple-ca8.pages.dev

Commit: 9fb683169354ffbdcc5d9c157c7a2406af4038d2

Uses development API, billing, flags and PCR configuration. Cloudflare Access applies.