Close admin trust audit gaps and stabilize live sweeps

src/Router/StellaOps.Gateway.WebService/Middleware/RouteDispatchMiddleware.cs

@@ -26,6 +26,7 @@ public sealed class RouteDispatchMiddleware
     // ReverseProxy paths that are legitimate browser navigation targets (e.g. OIDC flows)
     // and must NOT be redirected to the SPA fallback.
     private static readonly string[] BrowserProxyPaths = ["/connect", "/.well-known"];
+    private static readonly string[] SpaRoutesWithDocumentExtensions = ["/docs", "/docs/"];
 
     public RouteDispatchMiddleware(
         RequestDelegate next,
@@ -134,7 +135,7 @@ public sealed class RouteDispatchMiddleware
         var spaFallback = route.Headers.TryGetValue("x-spa-fallback", out var spaValue) &&
                           string.Equals(spaValue, "true", StringComparison.OrdinalIgnoreCase);
 
-        if (spaFallback && !System.IO.Path.HasExtension(relativePath))
+        if (spaFallback && ShouldServeSpaFallback(relativePath))
         {
             var indexFile = fileProvider.GetFileInfo("/index.html");
             if (indexFile.Exists && !indexFile.IsDirectory)
@@ -646,4 +647,22 @@ public sealed class RouteDispatchMiddleware
         var accept = request.Headers.Accept.ToString();
         return accept.Contains("text/html", StringComparison.OrdinalIgnoreCase);
     }
+
+    private static bool ShouldServeSpaFallback(string relativePath)
+    {
+        if (!System.IO.Path.HasExtension(relativePath))
+        {
+            return true;
+        }
+
+        foreach (var prefix in SpaRoutesWithDocumentExtensions)
+        {
+            if (relativePath.StartsWith(prefix, StringComparison.OrdinalIgnoreCase))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
 }