Migrate logicsrc-web from Vite SPA to Next.js 16 App Router

Replaces the Vite single-page app + custom Node server.js with a Next.js
16.2.6 App Router app.

- proxy.ts (src/proxy.ts): www.logicsrc.com -> logicsrc.com 301 over https,
  preserving path + query (the original request, now via Next 16 Proxy).
- One SSR page via an optional catch-all ([[...slug]]) that renders the same
  marketing/spec page for each known top-level route (/docs, /blog, /openspec,
  ...) and 404s unknown paths, preserving existing canonical URLs. Markup is a
  faithful server-rendered port of the old main.ts (SEO upgrade over the prior
  client render); interactivity (hire-us form, CoinPay button, section scroll)
  moves to a client component.
- API routes ported to app/api/**: hire-us coinpay-checkout + project-request,
  oauth/coinpay start/callback/session, webhooks/coinpay. Shared logic in
  src/lib/coinpay.ts (eligibility, payment-rail selection, webhook verify,
  HMAC session sign/verify, cookies).
- commandboard-api (/health + /api/boards|tasks|plugins/*) is no longer mounted
  in-process; next.config.ts proxies those paths to COMMANDBOARD_API_URL via
  afterFiles rewrites (our own /api routes match first).
- Build/start switch to next build / next start. Contract tests rewritten to
  exercise proxy.ts, the route handlers, and pure helpers directly (21 passing);
  Playwright webServer updated.

Deployment (Railway): set COMMANDBOARD_API_URL to the commandboard-api service
URL and run it as its own service; root start now runs next start.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/logicsrc-web/src/app/api/oauth/coinpay/callback/route.ts

@@ -0,0 +1,104 @@
+import { NextResponse } from "next/server";
+import type { NextRequest } from "next/server";
+import { json } from "@/lib/http";
+import {
+  COINPAY_OAUTH_STATE_COOKIE,
+  COINPAY_SESSION_COOKIE,
+  getCoinPayOAuthConfig,
+  parseJson,
+  serializeCookie,
+  signSession
+} from "@/lib/coinpay";
+
+export const dynamic = "force-dynamic";
+
+function redirectWithOAuthStatus(status: string, error?: string): NextResponse {
+  const params = new URLSearchParams({ coinpay_oauth: status });
+  if (error) {
+    params.set("error", error);
+  }
+  return new NextResponse(null, { status: 302, headers: { location: `/?${params.toString()}` } });
+}
+
+// GET /api/oauth/coinpay/callback — validate state, exchange the code for tokens,
+// fetch userinfo, and store a signed session cookie.
+export async function GET(request: NextRequest) {
+  const config = getCoinPayOAuthConfig();
+  if (!config) {
+    return json({ success: false, error: "CoinPay OAuth is not configured" }, 503);
+  }
+
+  const url = request.nextUrl;
+  const callbackError = url.searchParams.get("error");
+  if (callbackError) {
+    return redirectWithOAuthStatus("error", callbackError);
+  }
+
+  const code = url.searchParams.get("code");
+  const state = url.searchParams.get("state");
+  const expectedState = request.cookies.get(COINPAY_OAUTH_STATE_COOKIE)?.value;
+
+  if (!code) {
+    return redirectWithOAuthStatus("error", "missing_code");
+  }
+
+  if (!state || !expectedState || state !== expectedState) {
+    return redirectWithOAuthStatus("error", "invalid_state");
+  }
+
+  try {
+    const tokenResponse = await fetch(new URL("/api/oauth/token", config.issuer), {
+      method: "POST",
+      headers: { "content-type": "application/x-www-form-urlencoded" },
+      body: new URLSearchParams({
+        grant_type: "authorization_code",
+        code,
+        redirect_uri: config.redirectUri,
+        client_id: config.clientId,
+        client_secret: config.clientSecret
+      })
+    });
+    const tokenText = await tokenResponse.text();
+    const tokenPayload = parseJson(tokenText);
+
+    if (!tokenResponse.ok || typeof tokenPayload.access_token !== "string") {
+      console.error("[coinpay-oauth] token exchange failed", {
+        status: tokenResponse.status,
+        error: (tokenPayload.error as string) || tokenText.slice(0, 160)
+      });
+      return redirectWithOAuthStatus("error", "token_exchange_failed");
+    }
+
+    const userResponse = await fetch(new URL("/api/oauth/userinfo", config.issuer), {
+      headers: { authorization: `Bearer ${tokenPayload.access_token}` }
+    });
+    const userText = await userResponse.text();
+    const userInfo = userResponse.ok ? parseJson(userText) : {};
+
+    const session = signSession({
+      provider: "coinpay",
+      sub: typeof userInfo.sub === "string" ? userInfo.sub : null,
+      email: typeof userInfo.email === "string" ? userInfo.email : null,
+      name: typeof userInfo.name === "string" ? userInfo.name : null,
+      scope: typeof tokenPayload.scope === "string" ? tokenPayload.scope : config.scopes,
+      connected_at: new Date().toISOString()
+    });
+
+    const response = new NextResponse(null, {
+      status: 302,
+      headers: { location: "/?coinpay_oauth=connected" }
+    });
+    response.headers.append(
+      "set-cookie",
+      serializeCookie(COINPAY_SESSION_COOKIE, session, { maxAge: 60 * 60 * 24 * 30, path: "/" })
+    );
+    response.headers.append(
+      "set-cookie",
+      serializeCookie(COINPAY_OAUTH_STATE_COOKIE, "", { maxAge: 0, path: "/api/oauth/coinpay" })
+    );
+    return response;
+  } catch (error) {
+    console.error("[coinpay-oauth] callback failed", error);
+    return redirectWithOAuthStatus("error", "callback_failed");
+  }
+}