… Node-free

U4 slice 3 (console RFC D1). `Goldpath.Console` embeds the built single page and maps it
on the management head, so an adopter runs the console the way they run everything else:
one line in their app. Node is needed in exactly ONE place — Goldpath's CI, before the
pack — and the package refuses to pack without a built console rather than shipping a
mapper that 404s in every adopter's face.

Decisions worth the words:
- the REGISTRY is configuration (`AddService`), not a JSON file someone must copy beside
  the dist: an adopter who already declares services in config should not declare them
  twice, and the same dist then works everywhere;
- the console sits behind the SAME ops floor as the admin surfaces — it drives them, so
  it inherits their guard, from the same shared source (H2);
- a missing ASSET 404s instead of being answered with the page. A console that "loads"
  into a blank screen with a green status code is the worst failure it can have;
- an unknown PATH 404s too, because the console has no client-side routes yet: serving
  the page there would answer 200 with a document whose relative assets resolve a
  directory too deep. Recorded as open-threads T9, with what must change when routes
  arrive (the server injects a `<base href>`, and the tests flip with it).

The serving logic is internal-but-tested so its three outcomes — the page, a missing
asset, a package built without a console — are proven deterministically rather than
depending on whether the machine running the tests happened to build the dist.

Proof: the smoke now builds the dist, the test host maps the console, and Playwright
drives THAT console (not the dev server) — its assets load clean, its registry is the
three services the app configured, and the 404 shapes hold. 21/21 green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ADR-0003 in one line: the hand-rolled extension→MIME switch is what
FileExtensionContentTypeProvider already does, and better — it knows the types a future
asset will use without anyone remembering to add them. Unknown extensions still fall back
to bytes rather than a guess.

Also notes, in the test that raised R5, WHY the camelCase payload binds to PascalCase
records without options: GetFromJsonAsync reads with JsonSerializerDefaults.Web, which is
case-insensitive. Checked rather than assumed.

21/21.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>