v0.165.0: Indítópult megosztása — guest launcher via capability URL (+ optional password, QR)

Mint a 160-bit capability URL (/s/<token>) serving a standalone read-only guest
launcher: same tiles, opens apps in new tabs, no account, no admin session.
Information only, zero control — every privilege stays behind each app's own auth.

- /s/ pre-auth pass-through (after the claim gate) + session-CSRF exemption; guest
  password POST carries its own pre-auth HMAC CSRF.
- Constant-time token match; empty stored token = disabled = byte-identical mux 404.
- Optional per-share password: separate bcrypt hash + own attempt map; signed cookie
  = HMAC(token|passwordHash) keyed with web.session_secret, so rotate/change invalidates.
- Guest labels ride the v0.164.0 ruling; never expose internal state vocabulary.
- Token redacted in logs (/s/<redacted>); never in CHANGELOG/REPORT/CONTEXT.
- Admin modal: copy-link, QR (go-qrcode), set/clear password, rotate, disable.
- Tests: Groups A-G (14) + 3 red-proofs verified red.

CONTEXT.md

@@ -7,7 +7,29 @@
 >
 > Ask Claude Code: "Please update CONTEXT.md with what we did today"
 
-Last updated: 2026-07-24 (v0.164.0 — deliberately stopped apps no longer alarm; banner + email suppressed for StateStopped)
+Last updated: 2026-07-24 (v0.165.0 — Indítópult megosztása: guest launcher via capability URL /s/<token>, optional share password, QR)
+
+> **2026-07-24 — v0.165.0 (Indítópult megosztása — guest launcher via capability URL).** The admin
+> launcher gets an "Indítópult megosztása" button that mints a **capability URL**
+> (`https://<host>/s/<token>`, 160-bit `crypto/rand` token) serving a standalone, read-only guest
+> launcher — same tiles, opens apps in new tabs — with **no account and no admin session**. **Security
+> ruling: the link grants INFORMATION ONLY, ZERO CONTROL** — app names + public URLs; every privilege
+> stays behind each app's own auth and the controller admin password. The token IS the secret (160-bit
+> entropy is the whole defence for the GET — never rate-limited, never logged, `subtle.ConstantTimeCompare`
+> only; an empty stored token = sharing OFF, matches nothing, so a wrong/disabled token is byte-identical
+> to the mux default 404). Optional per-share password is a SEPARATE credential (own bcrypt hash, own
+> attempt map — NEVER the admin ones); one pass mints a cookie = HMAC(`token|passwordHash`) keyed with
+> the persisted `web.session_secret`, so rotate-token OR change-password invalidates all cookies for free.
+> **Part-2 secret decision: REUSED `web.session_secret`** (persisted + box-scoped + stable — the SAME
+> secret the claim pre-auth CSRF already trusts; not per-boot, not claim-generation-scoped → the reuse
+> branch), so no `ShareCookieSecret` field was added. **Design rulings recorded:** member accounts are
+> **superseded** by this capability-URL model; **per-member tile visibility is PARKED under the SSO arc.**
+> Guest state labels ride the v0.164.0 invariants: `StateStopped` ⇒ "A tulajdonos leállította"; any
+> other non-clickable state ⇒ "Átmenetileg nem elérhető" (guests never see stopped/exited/degraded/
+> unhealthy). Accepted residuals (documented, no code action): link-preview crawlers fetch once and see
+> app names (noindex prevents indexing); reverse-proxy/CF access logs may hold the path (ops-tier); the
+> modal link carries the request Host, so a LAN-IP admin session yields a LAN-IP link. New dep:
+> `github.com/skip2/go-qrcode`. Tests: Groups A–G (14 tests) + 3 red-proofs verified red.
 
 > **2026-07-24 — v0.164.0 (stopped ≠ fault).** Operator finding on 9201: a UI stop (Leállítás) raised
 > the global "Telepített alkalmazás nem fut: … (stopped)" banner on every page AND fired the