feat(web): serve the web app under /app and send every billing link there (WS-B)

apps/web was never deployed, so /billing on the public domain returned the
landing page and d3ro.dev (desktop "upgrade") did not resolve.

- apps/web runs with basePath /app and output standalone; /download and
  /releases redirect to the site's #download. A Dockerfile and a d3ro-web
  compose service (port 3002) deploy it to the NAS with the other images.
- The site bridge worker forwards /app/* to WEB_APP_ORIGIN (the tunnel host)
  and rewrites upstream redirects; everything else still goes to Pages.
  With no origin configured /app answers 503 instead of the landing page.
- Desktop upgrade, desktop Stripe return, mobile subscription management,
  the web checkout/portal returns and the site all use billingUrl(); the
  return query is success=1 / canceled=1, which the billing page reads.
  The billing page highlights ?tier=pro|pro_plus, and signing in from a
  billing link returns to the same plan.
- auth/callback pins the redirect origin in production and rejects
  protocol-relative next= values (open redirect).
- Mobile legal links use SITE_URLS (fixes the missing slash on /terms).
- Compose drops the unused NEXT_PUBLIC_API_URL and the dead wwwroot legal
  mounts; deploy scripts add the web image and the SUPABASE_* values the NAS
  compose already required; .dockerignore keeps app .env files out of images.
- Supabase auth redirects allow /app/** (remote dashboard must match).

Policy: docs/REFACTOR_POLICY.md Wave 3, W3-3 and W3-4.

apps/mobile-rn/src/features/teams/team-service.ts

@@ -1,5 +1,6 @@
 import type { RealtimeChannel } from '@supabase/supabase-js'
 import type { Meeting, Team, TeamRole } from '@d3ro/api-client'
+import { PUBLIC_SITE_ORIGIN, SITE_URLS } from '@d3ro/core/web-urls'
 import { supabase } from '../../lib/supabase'
 
 export interface TeamSummary extends Team {
@@ -99,7 +100,9 @@ const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
 const INVITE_TOKEN_PATTERN = /^[A-Za-z0-9_-]{32}$/
 const TEAM_NAME_MAX_LENGTH = 80
 const EMAIL_MAX_LENGTH = 254
-const TRUSTED_INVITE_ORIGIN = 'https://d3ro.chanpaca.net'
+const TRUSTED_INVITE_ORIGIN = PUBLIC_SITE_ORIGIN
+// '/accept-invite' — 사이트 정본 URL에서 경로만 떼어 끝 슬래시 유무를 모두 허용한다.
+const INVITE_PATH = SITE_URLS.acceptInvite.slice(PUBLIC_SITE_ORIGIN.length).replace(/\/$/, '')
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value)
@@ -181,7 +184,7 @@ export function normalizeInviteUrl(value: string): string {
   }
   if (
     parsed.origin !== TRUSTED_INVITE_ORIGIN
-    || (parsed.pathname !== '/accept-invite' && parsed.pathname !== '/accept-invite/')
+    || (parsed.pathname !== INVITE_PATH && parsed.pathname !== `${INVITE_PATH}/`)
     || parsed.username !== ''
     || parsed.password !== ''
     || parsed.hash !== ''

apps/mobile-rn/src/lib/billing-context.tsx

@@ -9,6 +9,7 @@ import {
   type ReactNode,
 } from 'react'
 import { Linking, Platform } from 'react-native'
+import { billingUrl } from '@d3ro/core/web-urls'
 import {
   ErrorCode,
   deepLinkToSubscriptions,
@@ -541,7 +542,7 @@ export function BillingProvider({ children }: { children: ReactNode }): React.Re
       })
       return
     }
-    await Linking.openURL('https://d3ro.chanpaca.net/billing')
+    await Linking.openURL(billingUrl())
   }, [entitlement.snapshot.provider, entitlement.snapshot.storeProductId])
 
   const clearOperation = useCallback(() => {

apps/mobile-rn/src/screens/ProPaywallScreen.tsx

@@ -24,6 +24,7 @@ import {
 } from '../lib/mobile-ads-context'
 import { useMobilePreferences } from '../lib/preferences-context'
 import { ThemeButton, ThemeCard, ThemeText } from '../theme/themed-components'
+import { SITE_URLS } from '@d3ro/core/web-urls'
 
 type Navigation = NativeStackNavigationProp<RootStackParamList, 'ProPaywall'>
 type TranslationKey = Parameters<ReturnType<typeof useI18n>['t']>[0]
@@ -305,7 +306,7 @@ export default function ProPaywallScreen(): React.ReactElement {
           <Pressable
             accessibilityRole="link"
             accessibilityLabel={t('mobile.paywall.terms')}
-            onPress={() => void Linking.openURL('https://d3ro.chanpaca.net/terms')}
+            onPress={() => void Linking.openURL(SITE_URLS.terms)}
             style={styles.legalLink}
           >
             <ThemeText variant="small" color="accent">{t('mobile.paywall.terms')}</ThemeText>
@@ -314,7 +315,7 @@ export default function ProPaywallScreen(): React.ReactElement {
           <Pressable
             accessibilityRole="link"
             accessibilityLabel={t('mobile.paywall.privacy')}
-            onPress={() => void Linking.openURL('https://d3ro.chanpaca.net/privacy/')}
+            onPress={() => void Linking.openURL(SITE_URLS.privacy)}
             style={styles.legalLink}
           >
             <ThemeText variant="small" color="accent">{t('mobile.paywall.privacy')}</ThemeText>

apps/mobile-rn/src/screens/SettingsScreen.tsx

@@ -11,6 +11,7 @@ import {
 import { useSafeAreaInsets } from 'react-native-safe-area-context'
 import { useNavigation } from '@react-navigation/native'
 import { useI18n, type TranslationKey } from '@d3ro/i18n'
+import { SITE_URLS } from '@d3ro/core/web-urls'
 import { useAuth } from '../lib/auth-context'
 import { useEntitlement } from '../lib/entitlement-context'
 import {
@@ -475,21 +476,21 @@ export default function SettingsScreen(): React.ReactElement {
           label={t('mobile.set.privacyPolicy')}
           hint={t('mobile.set.privacyPolicyHint')}
           testID="settings-privacy-policy"
-          onPress={() => void Linking.openURL('https://d3ro.chanpaca.net/privacy/')}
+          onPress={() => void Linking.openURL(SITE_URLS.privacy)}
         />
         <LegalLinkRow
           label={t('mobile.set.termsOfService')}
           hint={t('mobile.set.termsOfServiceHint')}
           testID="settings-terms-of-service"
           bordered
-          onPress={() => void Linking.openURL('https://d3ro.chanpaca.net/terms/')}
+          onPress={() => void Linking.openURL(SITE_URLS.terms)}
         />
         <LegalLinkRow
           label={t('mobile.set.accountDeletion')}
           hint={t('mobile.set.accountDeletionHint')}
           testID="settings-account-deletion-web"
           bordered
-          onPress={() => void Linking.openURL('https://d3ro.chanpaca.net/delete-account/')}
+          onPress={() => void Linking.openURL(SITE_URLS.deleteAccount)}
         />
       </ThemeCard>
 

apps/mobile-rn/src/screens/SignUpScreen.tsx

@@ -21,6 +21,7 @@ import {
   d3roNativeFonts,
 } from '@d3ro/ui-native'
 import { useI18n } from '@d3ro/i18n'
+import { SITE_URLS } from '@d3ro/core/web-urls'
 import { isSupabaseConfigured, supabase } from '../lib/supabase'
 import { AUTH_REDIRECT_URL } from '../lib/auth-redirect'
 import { getAuthCapabilities, type AuthCapabilities } from '../lib/auth-capabilities'
@@ -346,7 +347,7 @@ export default function SignUpScreen(): React.ReactElement {
             accessibilityRole="link"
             accessibilityLabel={t('mobile.set.termsOfService')}
             testID="sign-up-terms-link"
-            onPress={() => void Linking.openURL('https://d3ro.chanpaca.net/terms/')}
+            onPress={() => void Linking.openURL(SITE_URLS.terms)}
             style={styles.legalLink}
             disabled={interfaceBusy}
           >
@@ -361,7 +362,7 @@ export default function SignUpScreen(): React.ReactElement {
             accessibilityRole="link"
             accessibilityLabel={t('mobile.set.privacyPolicy')}
             testID="sign-up-privacy-link"
-            onPress={() => void Linking.openURL('https://d3ro.chanpaca.net/privacy/')}
+            onPress={() => void Linking.openURL(SITE_URLS.privacy)}
             style={styles.legalLink}
             disabled={interfaceBusy}
           >