[sup] Same-origin deployment: static artifact in ACM docroot, <Location> CSP, acm-ui link

Empieza leyendo la discusión sobre artefactos y compilación en este repositorio; después, inspecciona acm's distrib/build.sh y la configuración de vhost, así como la página cluster/explore de acm-ui. Resuelve el enfoque de entrega de artefactos y CSP en los tres repositorios, comprobando también release.yml y docker.yml en busca de rutas no intencionadas de publicación pública. Se considera terminado cuando el artefacto /sql/, el flujo de cookie-auth, CSP, la ruta de archivo concreta, el enlace contextual y las salvaguardas de publicación cumplen las comprobaciones de aceptación indicadas.

Part of #352. Reworked: same-origin static deployment into ACM, not a public release tag.

Our SPA ships as a static file in the altinity/acm image docroot, served same-origin at a concrete path (e.g. /sql/), opened in a new tab from acm-ui.

Our repo (altinity-sql-browser)

• Build the artifact so it runs under ACM (see CSP below): either keep the single inline-<script> file and rely on a scoped ACM <Location> CSP, or add a build mode emitting external JS from 'self' (no inline/eval).
• Select ACM cookie-auth mode at runtime (URL context) rather than a separate bundle if practical.
• Decide artifact delivery to ACM: committed asset, pinned GitHub release download, or built in acm-ui's pipeline.

acm repo (backend/distrib)

• distrib/build.sh: place our built file into the docroot / tar (/var/www/html/sql/…).
• vhost: add a <Location /sql/> CSP block (mirror the existing /api/ CSP: 'self' 'unsafe-inline' 'unsafe-eval' *.gstatic.com data:). Needed because the strict page CSP blocks our inline bundle.
• Serve as a real file at a concrete path (FallbackResource /index.html would otherwise return the Angular shell).

acm-ui repo

• Add a link on the cluster/explore page → /sql/?cluster=<id>&node=<n> (target=_blank).

Do NOT

• vX.Y.Z-sup tag — release.yml fires on v* and docker.yml on v*.*.* (+latest); a -sup tag would enter public GitHub Release / Helm / Docker latest. Deployment here is via the ACM image, not this repo's public tags.

Acceptance

• Artifact served same-origin at /sql/; cookie auth works end-to-end in the console.
• <Location /sql/> CSP allows the app; page loads with no CSP violations.
• Concrete-path file (not swallowed by FallbackResource).
• acm-ui link opens the new tab with cluster/node context.
• No public-release/Helm/Docker path is triggered by this work.