feat(web): serve the web app under /app and send every billing link there (WS-B)

apps/web was never deployed, so /billing on the public domain returned the
landing page and d3ro.dev (desktop "upgrade") did not resolve.

- apps/web runs with basePath /app and output standalone; /download and
  /releases redirect to the site's #download. A Dockerfile and a d3ro-web
  compose service (port 3002) deploy it to the NAS with the other images.
- The site bridge worker forwards /app/* to WEB_APP_ORIGIN (the tunnel host)
  and rewrites upstream redirects; everything else still goes to Pages.
  With no origin configured /app answers 503 instead of the landing page.
- Desktop upgrade, desktop Stripe return, mobile subscription management,
  the web checkout/portal returns and the site all use billingUrl(); the
  return query is success=1 / canceled=1, which the billing page reads.
  The billing page highlights ?tier=pro|pro_plus, and signing in from a
  billing link returns to the same plan.
- auth/callback pins the redirect origin in production and rejects
  protocol-relative next= values (open redirect).
- Mobile legal links use SITE_URLS (fixes the missing slash on /terms).
- Compose drops the unused NEXT_PUBLIC_API_URL and the dead wwwroot legal
  mounts; deploy scripts add the web image and the SUPABASE_* values the NAS
  compose already required; .dockerignore keeps app .env files out of images.
- Supabase auth redirects allow /app/** (remote dashboard must match).

Policy: docs/REFACTOR_POLICY.md Wave 3, W3-3 and W3-4.

apps/desktop/src/main/ipc/license-handlers.ts

@@ -11,6 +11,10 @@ import type {
   LicenseInfo,
 } from '@d3ro/core/types'
 import { Feature } from '@d3ro/core/types'
+import { billingUrl, PUBLIC_SITE_ORIGIN } from '@d3ro/core/web-urls'
+
+/** 개발 빌드는 로컬 웹앱(`npm run dev --workspace=@d3ro/web`)의 결제 페이지를 연다. */
+const DEV_WEB_ORIGIN = 'http://localhost:3000'
 
 /** 업그레이드 유도 이벤트를 모든 렌더러에 broadcast */
 function broadcastUpgradePrompt(event: UpgradePromptEvent): void {
@@ -100,9 +104,8 @@ export function registerLicenseHandlers(): void {
 
   ipcMain.handle(IPC_CHANNELS.LICENSE.OPEN_BILLING, async (_event, params: { tier: 'pro' | 'pro_plus' }) => {
     try {
-      const baseUrl = app.isPackaged ? 'https://d3ro.dev' : 'http://localhost:3000'
-      const billingUrl = `${baseUrl}/billing?tier=${params.tier}`
-      await shell.openExternal(billingUrl)
+      const url = billingUrl({ tier: params.tier })
+      await shell.openExternal(app.isPackaged ? url : url.replace(PUBLIC_SITE_ORIGIN, DEV_WEB_ORIGIN))
       return ipcSuccess(undefined)
     } catch (err) {
       return ipcError(ErrorCode.UnknownError, `Failed to open billing: ${err}`)

apps/desktop/src/main/ipc/payment-handlers.ts

@@ -6,12 +6,13 @@ import { ipcMain } from 'electron'
 import { IPC_CHANNELS } from '@d3ro/core/ipc-channels'
 import { ErrorCode, ipcError, ok, type IPCResult } from '@d3ro/core/errors'
 import type { CheckoutSessionParams, CheckoutSessionResult } from '@d3ro/core/types'
+import { billingUrl } from '@d3ro/core/web-urls'
 import { getCloudSyncService } from '../services/CloudSyncService'
 
 const CHECKOUT_FUNCTION = 'stripe-checkout'
 const SUBSCRIPTION_FUNCTION = 'payple-manage'
-const CHECKOUT_SUCCESS_URL = 'https://d3ro.chanpaca.net/billing?desktop_checkout=success'
-const CHECKOUT_CANCEL_URL = 'https://d3ro.chanpaca.net/billing?desktop_checkout=cancelled'
+const CHECKOUT_SUCCESS_URL = billingUrl({ result: 'success' })
+const CHECKOUT_CANCEL_URL = billingUrl({ result: 'canceled' })
 const STRIPE_CHECKOUT_ORIGIN = 'https://checkout.stripe.com'
 const STRIPE_CHECKOUT_PATH_PREFIX = '/c/pay/'
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i

apps/desktop/tests/unit/license-open-billing.spec.ts

@@ -0,0 +1,50 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import { app, ipcMain, shell } from 'electron'
+import { IPC_CHANNELS } from '@d3ro/core/ipc-channels'
+
+vi.mock('../../src/main/services/LicenseService', () => ({
+  getLicenseService: () => ({ on: vi.fn() })
+}))
+
+import { registerLicenseHandlers } from '../../src/main/ipc/license-handlers'
+
+type CapturedHandler = (...args: unknown[]) => unknown
+
+const handlers = new Map<string, CapturedHandler>()
+
+async function openBilling(tier: 'pro' | 'pro_plus'): Promise<unknown> {
+  const handler = handlers.get(IPC_CHANNELS.LICENSE.OPEN_BILLING)
+  if (!handler) throw new Error('Missing OPEN_BILLING handler')
+  return handler({}, { tier })
+}
+
+function setPackaged(value: boolean): void {
+  Object.defineProperty(app, 'isPackaged', { value, configurable: true, writable: true })
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  handlers.clear()
+  vi.mocked(ipcMain.handle).mockImplementation((channel: string, handler: CapturedHandler) => {
+    handlers.set(channel, handler)
+  })
+  registerLicenseHandlers()
+})
+
+describe('LICENSE.OPEN_BILLING', () => {
+  it('opens the single web billing entry with the chosen tier in packaged builds', async () => {
+    setPackaged(true)
+    try {
+      await expect(openBilling('pro_plus')).resolves.toEqual({ success: true, data: undefined })
+      expect(shell.openExternal).toHaveBeenCalledWith('https://d3ro.chanpaca.net/app/billing?tier=pro_plus')
+    } finally {
+      setPackaged(false)
+    }
+  })
+
+  it('opens the local web app under the same base path in development', async () => {
+    setPackaged(false)
+    await openBilling('pro')
+    expect(shell.openExternal).toHaveBeenCalledWith('http://localhost:3000/app/billing?tier=pro')
+  })
+})

apps/desktop/tests/unit/payment-handlers.spec.ts

@@ -85,8 +85,8 @@ describe('desktop payment IPC security boundary', () => {
     expect(name).toBe('stripe-checkout')
     expect(body).toEqual({
       tier: 'pro',
-      success_url: 'https://d3ro.chanpaca.net/billing?desktop_checkout=success',
-      cancel_url: 'https://d3ro.chanpaca.net/billing?desktop_checkout=cancelled',
+      success_url: 'https://d3ro.chanpaca.net/app/billing?success=1',
+      cancel_url: 'https://d3ro.chanpaca.net/app/billing?canceled=1',
       idempotency_key: expect.stringMatching(/^desktop:stripe-checkout:[0-9a-f-]{36}$/)
     })
     expect(options).toMatchObject({ timeoutMs: PAYMENT_REQUEST_TIMEOUT_MS })