feat(marketing): add app login, signup, and dashboard navigation

[ORESoftware]

Summary

• adds polished Log in, Sign up, and Dashboard actions for https://app.zpkg.net to the zpkg.net GitHub Pages header;
• keeps account actions visible while the longer technical navigation collapses at narrower widths;
• adds mobile wrapping, keyboard focus states, and an orange dashboard primary action;
• updates the footer product link from the legacy web.zpkg.net label to app.zpkg.net;
• extends the Playwright contract to verify the exact account destinations and desktop/mobile visibility.

Final scope after cross-agent reconciliation

The final diff is intentionally limited to:

• src/layouts/Base.astro
• tests/site_contract.py

An overlapping agent had added Sonus-only validation fixtures plus a client/service-worker polling implementation to this Zpkg Pages branch. Those files were removed without rewriting history because they belonged to another product and depended on server endpoints that Zpkg does not expose.

This PR is therefore a credential-free, link-only marketing change. The session-aware cross-product contract is tracked separately in DEN-3420.

Authentication boundary

The public site never receives Shared Auth, Supabase, registry, or R2 credentials. The destinations are server-owned routes implemented by merged zed-pkg/zed-web-server.rs#19 (e158a1c4c7fb90707323f0ccd5e6223459d41212), preserving the server-side PKCE/BFF design and host-only signed product cookie.

Exact-head verification

Head 1af9ece51339e2dcf23a6bdc74e7ed380ecce776 is green for:

• public site contract, including desktop and 390px account-action assertions;
• opto-sync real web application e2e;
• agents policy.

The PR is mergeable, changes two files, and has no unresolved review threads.

Shared Auth test-org signal and separated rollout gate

shared-auth-test/server-api-contract-e2e#21 successfully built the exact merged Zpkg Rust web server and its independent protocol/PostgreSQL lane is green. Its additional Chromium run currently stops on a Playwright page.waitForURLnet::ERR_ABORTED navigation-wait condition after callback; this is tracked as harness/full-auth follow-up and does not invalidate the static Pages link/build checks above.

Merging this marketing-only PR does not certify or deploy the Shared Auth registered-client rollout. shared-auth/shared-auth-server.rs#69, the reviewed schema migration, client/secret provisioning, and deployed callback/state/PKCE/replay/revocation/audience/provider-isolation checks remain separate production gates.

Linear: DEN-2859; session-aware follow-up: DEN-3420.

[ORESoftware]

Current-head certification is now running in shared-auth-test/server-api-contract-e2e#21.

That test-fleet PR changes only two immutable pins:

• Shared Auth #69: a471b20f8f81094f57393dc797b3cad0868c2f40
• merged Zed Rust web server: e158a1c4c7fb90707323f0ccd5e6223459d41212

The prior independent certification pinned Shared Auth 3e1d0dac..., which is three runtime/security commits behind the current PR head, so it is not sufficient for this Pages rollout. Keep this Pages PR in draft until the new exact-source, PostgreSQL protocol, locked Rust build, and Chromium BFF workflows finish and are reviewed. Production secret/migration/DNS gates remain separate even if disposable certification is green.

[ORESoftware]

Cross-agent reconciliation is complete at exact head 1af9ece51339e2dcf23a6bdc74e7ed380ecce776.

• Final diff is back to the intended two files: src/layouts/Base.astro and tests/site_contract.py.
• agents policy, the public Playwright site contract, and opto-sync cross-application E2E are green on that exact head.
• Sonus-only workflows/fixtures and the unsupported session polling/service-worker files were removed without force-pushing or rewriting branch history.
• The rejected dynamic proposal is now tracked correctly as cross-product follow-up DEN-3420, owned by each product's Rust server.

This PR remains draft for one reason only: the registered-client handoff certification in shared-auth-test/server-api-contract-e2e#21 is still action_required across every workflow, with no jobs started. That is not test evidence. Once the Shared Auth exact head, migration, Zpkg client secrets, and callback/PKCE/replay/revocation/audience/provider-isolation E2E are certified, this clean Pages change is ready to publish.

[linear-code]

DEN-3423