--lan first load: redirect commits the key cookie; static goes public

The phone's first visit 403'd its own subresources: Safari's preload
scanner fetches /static/* before the document response's Set-Cookie is
committed, and favicon/apple-touch-icon probes are cookie-less system
fetches. A ?k= visit now answers 303-with-cookie to the same path —
the cookie is committed before any document loads, and the key is
scrubbed from the phone's address bar and history. /static/* and the
icon probe paths are exempt from the key: they're the app's own
css/js/artwork, no user data (shelf photos stay gated).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016jXZFSTZQKzAC8fqpWSz9g

tests/test_webreview.py

@@ -919,9 +919,14 @@ def test_lan_token_gates_every_request(tmp_path):
     # reads are gated too: shelf photos and state are private
     assert phone.get("/api/state").status_code == 403
     assert phone.get("/api/state?k=wrong").status_code == 403
-    first = phone.get("/titles?k=sekret")
-    assert first.status_code == 200
-    assert "bggpipe_key" in first.cookies  # the URL key becomes a cookie
+    # the app's own assets are public: the preload scanner fetches them
+    # before the document's cookie commits
+    assert phone.get("/static/app.css").status_code == 200
+    first = phone.get("/titles?k=sekret", follow_redirects=False)
+    assert first.status_code == 303  # cookie commits BEFORE the document
+    assert first.headers["location"] == "/titles"  # key scrubbed from URL
+    assert "bggpipe_key" in first.cookies
+    assert phone.get("/titles").status_code == 200  # cookie carries it now
     # cookie carries the session: mutations work from ANY host the phone
     # used (no allowlist dependence — DHCP/multi-interface safe), with a
     # same-origin Origin header and a port, like a real phone browser