[214] Stop serving the README and repository docs tree from the app server

[CarsonDavis]

Closes #214

The app server served two things out of the repository that have nothing to do with the running app: the repo's README.md at its own URL, and the entire docs/ tree as a browsable static file directory. Both were auth-exempt in practice — ensureUser() short-circuits whenever there is no authorization header and AUTH != "local", which is the lean/dashboard configuration and what the e2e workflow sets — so every deployment published its architecture decision records, drafts, planning notes, and research scratch to anyone who asked. Neither mount was a deliberate product decision; both are inherited.

This PR removes both, relocates the two files that genuinely depended on the docs mount, and stops the tree from shipping in the container image.

What changed

scripts/server.js

• Removed the /README.md static mount. It dates to the original 2019 server.js (MMGIS 1.1) and was kept through a 2023 file-casing rename; a repo-wide grep across src/essence, configure/src, and docs found no consumers.
• Removed the /docs static mount.
• swaggerOptions now points at /public/swagger/swaggerCSS.css and /public/swagger/swaggerJS.js. These URLs remain absolute and still omit ROOT_PATH — that is the pre-existing behaviour, preserved deliberately rather than changed in passing. (It is arguably wrong under a non-empty root path, but that is a separate issue.)
• require("../docs/mmgis-openapi.json") is now require("../API/mmgis-openapi.json").

Relocations (via git mv, so history follows)

• docs/swagger/swaggerCSS.css → public/swagger/swaggerCSS.css
• docs/swagger/swaggerJS.js → public/swagger/swaggerJS.js
• docs/mmgis-openapi.json → API/mmgis-openapi.json

The swagger assets had to move somewhere still served — removing the mount does not error, the API reference page just silently loses its styling and script. The openapi spec is required at module load, so it had to move out of docs/ before the directory could be ignored, or the container would fail to boot.

.dockerignore

• Added docs. The tree reached the image through the Dockerfile's COPY . .; it is roughly 8 MB of repo files with no runtime purpose.

Verification

Booted from a worktree on this branch with AUTH=none (i.e. ensureUser() short-circuiting, the unauthenticated configuration the issue asks about) and curled it. Files confirmed present on disk, so the 404s reflect the removed mount rather than missing content:

Path	Status
/docs/MISSION_CONFIG_REFERENCE.md	404
/docs/adr/02102026-layout-handling.md	404
/docs/favicon.ico	404
/docs/404.html	404
/docs/mmgis-openapi.json	404
/docs/swagger/swaggerCSS.css	404
/README.md	404
/api/docs	200
/public/swagger/swaggerCSS.css	200
/public/swagger/swaggerJS.js	200
/configure	200
/public/docs/MMGIS_URL_sample.png	200

The served /api/docs HTML still injects both custom assets, now at their new paths:

<script src='/public/swagger/swaggerJS.js'></script>
<link href='/public/swagger/swaggerCSS.css' rel='stylesheet'>

Container image contents verified empirically rather than reasoned about — built a throwaway image over this build context and listed it: root docs/ is absent, while public/docs/, public/swagger/, and API/mmgis-openapi.json are all present. (.dockerignore patterns without a slash match only at the context root, so public/docs is unaffected.)

Tests: vitest run — 52 files, 786 tests, all passing. playwright test tests/e2e — 32 passed, 1 failed; the failure is smoke.spec.js asserting the page title matches /MMGIS/i against a local fixture database whose mission title is "Disasters Program - Demo Dashboard". Pre-existing and environmental, unrelated to this change.

Not in scope

Changing where or how documentation is published for readers, reorganising the documentation content, and auditing the other static mounts for the same auth weakness — each worth doing, each its own issue.

[github-actions]

🤖 Version Auto-Bumped

The version has been automatically incremented to 4.2.19-20260722

This commit was added to your PR branch. When you merge this PR, the new version will be included.

---

_{If you want a different version, update package.json manually and push to this PR.}