fix(admin): serve built SPA and include it in release builds

registerStaticSpa was never mounted, so production only exposed org-admin
APIs. Wire it after auth/API routes, fold admin:build into npm run build,
and install admin-web deps during deploy so admin-web/build ships with the
release for same-origin /admin/*.

hub/src/admin/plugin.ts

@@ -1,11 +1,12 @@
 /**
- * Registers org-admin HTTP surface: auth, org APIs, (later) static SPA.
+ * Registers org-admin HTTP surface: auth, org APIs, and the static SPA shell.
  */
 import cookie from "@fastify/cookie";
 import type { PrismaClient } from "@prisma/client";
 import type { FastifyInstance } from "fastify";
 import { registerAuthRoutes } from "./routes/authRoutes.js";
 import { registerOrgRoutes } from "./routes/orgRoutes.js";
+import { registerStaticSpa } from "./static.js";
 import type { LocalSecretEnvelope } from "../security/secretEnvelope.js";
 import type { ProviderReadinessProbe } from "../connections/providerReadiness.js";
 import type { FeishuReadinessProbe } from "../connections/feishuReadiness.js";
@@ -62,4 +63,7 @@ export async function registerAdminPlugin(
       ? { feishuConnectionReadinessProbe: config.feishuConnectionReadinessProbe }
       : {}),
   });
+
+  // After API + /admin/login so SPA fallback does not shadow auth routes.
+  await registerStaticSpa(app);
 }

hub/src/admin/static.ts

@@ -70,9 +70,9 @@ export async function registerStaticSpa(app: FastifyInstance): Promise<void> {
     }
   });
 
-  // SPA client-side route fallback. `/admin/login` is registered earlier as a
-  // static route and takes precedence; everything else under /admin/* serves
-  // the index so SvelteKit's client-side router can resolve the view.
+  // SPA client-side route fallback. Auth registers `/admin/login` first so it
+  // takes precedence; everything else under /admin/* serves the index so
+  // SvelteKit's client-side router can resolve the view.
   app.get("/admin", async (_request, reply) => {
     return reply.type("text/html; charset=utf-8").send(indexHtml);
   });