Make the private-dashboard CTA reflect the active runtime

[jskoiz]

Verified against main at 715c52e.

Impact

The non-public homepage always offers “sign in with GitHub” at /auth/login. That is correct only for a standalone server with OAuth configured. Local Vite/preview mode has no auth middleware; /auth/login falls through to the SPA, where auth is a reserved path and the router renders the homepage again. Local users get a no-op action even though their actual private dashboard is /dashboard backed by authenticated gh.

The browser currently distinguishes only public Worker builds from everything else, so it cannot render truthful actions for local CLI, standalone OAuth-enabled, and standalone OAuth-unconfigured deployments.

Concrete code references

• Homepage behavior is selected only by VITE_PUBLIC_DEPLOYMENT.
• Every non-public build renders the /auth/login CTA.
• Vite installs only dashboard API middleware, not auth routes.
• The SPA reserves auth and resolves that path back to home.
• The documented local private entry point is /dashboard.

Acceptance criteria

• The homepage receives or derives an explicit runtime capability: local CLI, standalone OAuth-enabled, standalone OAuth-unconfigured, or public-only Worker.
• Local Vite and preview present a private-dashboard action that opens /dashboard and accurately mentions authenticated gh.
• OAuth-enabled standalone deployments present /auth/login.
• OAuth-unconfigured standalone and public-only Worker deployments explain the limitation/configuration path instead of presenting a dead sign-in action.
• No homepage private action may silently route back to the same homepage.
• Update README/runtime documentation for the final capability contract.

Test expectations

• Factor runtime-to-CTA behavior into a testable boundary and cover every runtime capability above.
• Update the root App test so the local contract expects /dashboard, not /auth/login.
• Add or extend hosted-server/static integration coverage for OAuth configured and unavailable modes.
• Verify local npm run dev or preview behavior without performing an OAuth sign-in, then run npm run check.

Dependencies / order

Independent. Keep the browser/server boundary explicit if runtime capability is server-provided.

Non-goals

• Implementing OAuth inside Vite.
• Exposing or copying the local GitHub CLI token into the browser.
• Changing public /username behavior.
• Requiring OAuth for local CLI mode.