review fixes: seeded-auth hard gate, ci.yml build serialization, assets 404

- M1: E2E_REQUIRE_SEEDED_AUTH=1 in the CI e2e step makes login failures hard
  failures (loginAs throws, guards disabled, globalSetup refuses a pre-populated
  DB); auth.spec redirect test asserts outright under the flag; non-admin
  /admin test is now a real authorization assertion
- M2: ci.yml build step depends_on test — never two concurrent turbo builds
  on the shared workspace
- M3: unknown /assets/* paths 404 from the SPA catch-all instead of serving
  index.html with an immutable cache header; spec arm added
- minors: e2e step gets when: *image_build_when, health poll uses
  GATEWAY_PORT + AbortSignal.timeout, BETTER_AUTH_SECRET generated per run
  (no literal in tree), failure echoes artifact path, dev-guide documents the
  gate, stale verify-release comment fixed

apps/gateway/src/spa/serve-spa.e2e.spec.ts

@@ -11,7 +11,8 @@
  *   3. Unknown backend paths (/api, /mcp, /socket.io) are JSON 404s, never the
  *      SPA page — including with a query string (`/api?x=1`).
  *   4. Static files are served exactly; hashed /assets/ files get immutable
- *      cache headers, everything else revalidates (max-age=0).
+ *      cache headers, everything else revalidates (max-age=0), and a missing
+ *      /assets/ file is a 404 — never the SPA fallback.
  *   5. WEB_DIST_DIR unset disables SPA serving entirely.
  *   6. WEB_DIST_DIR pointing at a directory without index.html fails at boot.
  */
@@ -130,6 +131,19 @@ describe('SPA static serving — fixture dist dir', () => {
     expect(res.headers['cache-control']).toBe('public, max-age=31536000, immutable');
   });
 
+  it('missing /assets/ files are 404s, never the SPA page with an immutable header', async () => {
+    // The exact request a browser with a stale index.html makes after a
+    // deploy: the old hashed filename. Serving index.html here would poison
+    // caches with a year-long immutable entry whose body is HTML.
+    for (const missingAsset of ['/assets/app-old999.js', '/assets/app-old999.js?v=1']) {
+      const res = await request(app.getHttpServer()).get(missingAsset);
+      expect(res.status, missingAsset).toBe(404);
+      expect(res.text, missingAsset).not.toContain('mosaic spa fixture');
+      // The 404 carries no cache-control at all; ?? '' keeps the assertion valid.
+      expect(res.headers['cache-control'] ?? '', missingAsset).not.toContain('immutable');
+    }
+  });
+
   it('index.html and non-asset files revalidate (no immutable caching)', async () => {
     for (const revalidating of ['/', '/chat', '/favicon.svg']) {
       const res = await request(app.getHttpServer()).get(revalidating);

apps/gateway/src/spa/serve-spa.ts

@@ -75,6 +75,7 @@ export async function mountSpaStatic(app: NestFastifyApplication): Promise<void>
   // this catch-all; non-GET unmatched requests keep Fastify's stock 404.
   fastify.get('/*', (req, reply) => {
     const url = req.raw.url ?? '';
+    const pathOnly = url.split('?', 1)[0] ?? url;
     if (isBackendPath(url)) {
       // An unknown backend path is an API 404, never the SPA page.
       void reply.code(404).send({
@@ -84,6 +85,18 @@ export async function mountSpaStatic(app: NestFastifyApplication): Promise<void>
       });
       return;
     }
+    if (pathOnly === '/assets' || pathOnly.startsWith('/assets/')) {
+      // A missing hashed asset — typically a browser holding a stale
+      // index.html after a deploy — must 404. Falling through to the SPA
+      // fallback would return index.html as the asset body, and the onSend
+      // hook above would stamp it with a year-long immutable cache-control.
+      void reply.code(404).send({
+        message: `Asset ${pathOnly} not found`,
+        error: 'Not Found',
+        statusCode: 404,
+      });
+      return;
+    }
     // sendFile is decorated by @fastify/static; its type augmentation targets
     // a different fastify copy in the pnpm tree than the Nest adapter's.
     (reply as unknown as { sendFile: (file: string) => unknown }).sendFile('index.html');