[Backend][Deploy] #1971 routing residuals: nginx doesn't proxy /mcp (split topology), wrong-verb GET on POST-only routes now 404s not 405s, PWA denylist misses /hubs and /health

[Chris0Jeky]

Residuals from the Codex round on PR #1990 (post-fix-round head), tracked at the ceiling.

1. Split-container topology: deploy/nginx/reverse-proxy.conf proxies /api/, /hubs/, /health/ (trailing slash) but not /mcp and not the bare prefixes — so the new 404 contract is API-side only there; unknown /mcp/* and bare prefixes still get the SPA from nginx. One location block each closes it end-to-end.
2. Wrong-verb GET/HEAD on a real POST-only route (e.g. GET on a triage/execute endpoint) now routes to the GET fallback → 404, where the framework previously synthesized 405. Fail-safe and arguably enumeration-friendlier, but it is a contract change PR fix(backend): #1971 unknown /api/* returns 404, not the SPA fallback #1990's review missed — decide: accept-and-document (OpenAPI already implies methods) or restore 405 via a post-routing check.
3. PWA: vite.config.ts navigateFallbackDenylist covers /api/ and /mcp but not /hubs/ or /health/ — an installed PWA answers those NAVIGATIONS with the cached shell before the backend is consulted (pre-existing; bounds [Backend][API] Unknown /api/* paths return 200 + index.html — the SPA fallback swallows API 404s #1971's fix in the browser).

Refs: PR #1990, #1971, ADR-0036 amendment 2026-08-22.

[Chris0Jeky]

Partial delivery checkpoint (2026-08-24):

• PR Add PWA navigate fallback denylist entries for hub and health prefixes #2029 merged as 8dd03af. Installed-PWA navigations for the lowercase /hubs and /health bare prefixes, queries, and descendants now bypass the SPA fallback alongside the existing machine-prefix rules.
• PR fix(deploy): proxy machine prefixes in split topology #2030 merged as 5a6c85b. Both split-container nginx templates now send lowercase bare and descendant /api, /hubs, /health, and /mcp paths to the API container while preserving URI, forwarded headers, hub WebSocket handling, and unbuffered MCP SSE.
• Exact-head proof for fix(deploy): proxy machine prefixes in split topology #2030: static/rendered proxy parity passed; nginx 1.27 configuration validation passed; Terraform dev/staging/prod baseline passed; independent integration review found no CRITICAL/HIGH/MEDIUM defect; all hosted required checks and dynamic Playwright smoke passed.

Remaining acceptance work, so this parent stays open:

1. Decide and implement or explicitly reject case-insensitive parity for both PWA and nginx machine-prefix matching.
2. Wire Test-TaskdeckReverseProxyConfig.ps1 into an appropriate required CI lane.
3. Maintainer decision remains required for wrong-verb GET/HEAD on a real POST-only route: accept/document the current 404 contract or deliberately restore framework-style 405 behavior. No decision is inferred here.
4. Live split-container request and MCP SSE streaming proof has not been run; current evidence is static contract plus real nginx syntax validation.