Shared Sessions v0 (slice 10): hosted web join page (operator decision) #4481

PRD: .pan/drafts/pan-658.md (rev 3), section Operator decisions → OD-1

Part of PAN-658 Shared Sessions v0, slice 10. PAN-658 itself delivers slice 1: the Cloudflare share service (services/share/, a Worker plus one Durable Object per room) and the signaling protocol types in @overdeck/contracts. This slice builds on it.

Operator decision needed

The operator's goal (2026-10-02): "the operator can give someone a link to a conversation and that person can join it and talk with the AI directly." PRD rev 2 requires the joiner to have Overdeck installed. A hosted web view was excluded because "it would put conversation content on overdeck.ai."

That privacy reason holds only for a server-rendered view. A static page on share.overdeck.ai, running the same browser WebRTC viewer, keeps content peer-to-peer: the Worker serves only the static page and the signaling relay. The real blocker is sign-in. The account service has PKCE with a loopback redirect (a local dashboard) and device flow, but no browser web-session flow. A hosted join therefore needs a web sign-in flow in PAN-4293, and a browser-held identity for the viewer signaling WebSocket.

PAN-658 defaults to install-required and files this issue so the operator can choose. If approved, this issue adds:

1. A web sign-in flow on the account service.
2. A static viewer bundle served by the share Worker at /s/:code.
3. A browser viewer signaling WebSocket path authenticated by that web session.

Depends on

PAN-4475 (viewer surface), and an operator decision.