Answer 404 for unrouted paths, and keep the route lists honest

web/nginx.conf ended its try_files chain in an unconditional /200.html, so
every path the site does not have -- /wp-login.php, /.env, a typo'd inbound
link -- came back as the SPA shell with a success status. It now answers 404,
which needs nginx to know which routes exist: most it infers from the build
output, but dynamic routes and ones that never opted into prerendering have no
file on disk and are listed by hand.

Those hand-maintained lists drift, and the drift is invisible until it ships:
vite dev and npm run preview route from the client manifest and never read
nginx.conf, so a new dynamic route works everywhere a developer would look and
404s in production. hack/check-web-routes.sh compares the lists against
web/src/routes, and a workflow runs it. Its own workflow rather than another
job on license-compliance.yml, which already carries one unrelated check.

Also turns absolute_redirect off. With nginx's default the trailing-slash
canonicaliser reconstructs the origin from its own listen port, so a request
for https://demo.cairnobs.org/settings/ was answered with
Location: http://127.0.0.1:3000/settings -- the container's internal address,
unreachable from the client, and downgraded to http on the way. Verified by
curl against the built image; it was latent here before the canonicaliser
existed too, through the directory redirect on /dev.

.github/workflows/web-routes.yml

@@ -0,0 +1,27 @@
+name: Web route check
+
+# web/nginx.conf answers 404 for any path that isn't a route, which means
+# it has to know which routes exist. Most it infers from the build output,
+# but dynamic routes (dashboards/[id] and friends) and non-prerendered
+# routes (/data-sources) have no file on disk and are hand-listed there.
+#
+# That list drifting is a production-only failure: `vite dev` and
+# `npm run preview` route from the client manifest and never read
+# nginx.conf, so a new dynamic route works perfectly everywhere a
+# developer would look and 404s the moment it ships. This job is what
+# catches it. Its own workflow rather than another job bolted onto
+# license-compliance.yml, which already carries one unrelated check
+# (tenant-boundary) for historical reasons worth not compounding.
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+
+jobs:
+  web-routes:
+    name: nginx route allowlist check
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: bash hack/check-web-routes.sh