v0.165.0: Indítópult megosztása — guest launcher via capability URL (+ optional password, QR)

Mint a 160-bit capability URL (/s/<token>) serving a standalone read-only guest
launcher: same tiles, opens apps in new tabs, no account, no admin session.
Information only, zero control — every privilege stays behind each app's own auth.

- /s/ pre-auth pass-through (after the claim gate) + session-CSRF exemption; guest
  password POST carries its own pre-auth HMAC CSRF.
- Constant-time token match; empty stored token = disabled = byte-identical mux 404.
- Optional per-share password: separate bcrypt hash + own attempt map; signed cookie
  = HMAC(token|passwordHash) keyed with web.session_secret, so rotate/change invalidates.
- Guest labels ride the v0.164.0 ruling; never expose internal state vocabulary.
- Token redacted in logs (/s/<redacted>); never in CHANGELOG/REPORT/CONTEXT.
- Admin modal: copy-link, QR (go-qrcode), set/clear password, rotate, disable.
- Tests: Groups A-G (14) + 3 red-proofs verified red.

controller/internal/web/funcmap.go

@@ -84,6 +84,18 @@ func routeUnpublished(state stacks.ContainerState) bool {
 	}
 }
 
+// isOperationalState reports whether a stack has running containers (not stopped/exited/not-deployed).
+// Shared by the funcmap "isOperational" and the guest launcher's clickability rule (v0.165.0), so both
+// answer "is there something to open here" from a single source.
+func isOperationalState(state stacks.ContainerState) bool {
+	switch state {
+	case stacks.StateRunning, stacks.StateStarting, stacks.StateUnhealthy, stacks.StateRestarting, stacks.StateDegraded:
+		return true
+	default:
+		return false
+	}
+}
+
 // templateFuncMap returns the FuncMap used by all HTML templates.
 func (s *Server) templateFuncMap() template.FuncMap {
 	loc := getTimezone()
@@ -162,14 +174,7 @@ func (s *Server) templateFuncMap() template.FuncMap {
 		},
 		// isOperational returns true for any state where the stack has containers
 		// and is not stopped/exited — used by templates for showing action buttons
-		"isOperational": func(state stacks.ContainerState) bool {
-			switch state {
-			case stacks.StateRunning, stacks.StateStarting, stacks.StateUnhealthy, stacks.StateRestarting, stacks.StateDegraded:
-				return true
-			default:
-				return false
-			}
-		},
+		"isOperational": isOperationalState,
 		"routeUnpublished": routeUnpublished,
 		"logoURL": func(slug string) string {
 			return s.cfg.AppLogoURL(slug)