v0.165.0: Indítópult megosztása — guest launcher via capability URL (+ optional password, QR)

Mint a 160-bit capability URL (/s/<token>) serving a standalone read-only guest
launcher: same tiles, opens apps in new tabs, no account, no admin session.
Information only, zero control — every privilege stays behind each app's own auth.

- /s/ pre-auth pass-through (after the claim gate) + session-CSRF exemption; guest
  password POST carries its own pre-auth HMAC CSRF.
- Constant-time token match; empty stored token = disabled = byte-identical mux 404.
- Optional per-share password: separate bcrypt hash + own attempt map; signed cookie
  = HMAC(token|passwordHash) keyed with web.session_secret, so rotate/change invalidates.
- Guest labels ride the v0.164.0 ruling; never expose internal state vocabulary.
- Token redacted in logs (/s/<redacted>); never in CHANGELOG/REPORT/CONTEXT.
- Admin modal: copy-link, QR (go-qrcode), set/clear password, rotate, disable.
- Tests: Groups A-G (14) + 3 red-proofs verified red.

controller/internal/web/auth.go

@@ -83,8 +83,11 @@ func (s *Server) RequireAuth(next http.Handler) http.Handler {
 		}
 
 		// Claim/reset routes stay reachable pre-auth even on a claimed box: they are the RESET
-		// entry (code-gated internally). Static assets for the page too.
-		if r.URL.Path == "/claim" || r.URL.Path == "/claim/request-new-code" || strings.HasPrefix(r.URL.Path, "/static/") {
+		// entry (code-gated internally). Static assets for the page too. The guest launcher share
+		// (v0.165.0) joins here — /s/<token> is a capability URL with NO admin session; the token
+		// (or the optional share password) is its own gate. Placed AFTER the claim-gate block above,
+		// so an unclaimed box never serves the guest page (the claim gate stays supreme).
+		if r.URL.Path == "/claim" || r.URL.Path == "/claim/request-new-code" || strings.HasPrefix(r.URL.Path, "/static/") || strings.HasPrefix(r.URL.Path, "/s/") {
 			next.ServeHTTP(w, r)
 			return
 		}