The service worker was intercepting iframe navigation to app paths
(/notices/, /kitchen/ etc.) and serving the portal's cached index.html
before the request reached nginx — causing the 🚧 EmbeddedFallback.
Only apply the fallback to portal routes; everything else goes to network.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Portal's nginx is the actual entry point (original NPM proxies the whole
domain to the portal LXC). App paths need to be proxied here, not in the
stack NPM. Same pattern as /api/auth/ which already works.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
An un-routed app path falls back to serving the portal, which would otherwise
load the whole shell inside itself endlessly. Detect self-embedding and show a
'not available yet' placeholder instead.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
