feat: serve the web apps from the Backend (embedded, allow-listed, no filesystem access) so passkeys bind to the panel's own domain [CI]

backend/src/MoShiro.Backend.Api/ApiModule.cs

@@ -119,6 +119,7 @@ public static class ApiModule
 
         OpsEndpoints.Map(app);
         app.MapOpenApi("/openapi/v1.json");
+        app.MapStaticSite();
         return app;
     }