feat(honeybar): the HoneyOS bar, loaded at runtime

A strip along the top that leads to the other apps of the same system. It is
served by HoneyOS; InkNote only says where to find it, through
INKNOTE_HONEYBAR_ORIGIN. Empty means no bar and no change at all.

The origin is served by the API rather than built into the page, because an
image is pulled ready-made and a service worker keeps whole responses: anything
frozen into index.html would outlive the setting.

Layout follows the bar through --honeybar-h. The body has overflow:hidden, so
the surplus height would not have scrolled but been cut off at the bottom; and
#root padded itself around the notch that the bar now covers, which would have
counted that gap twice.

Unit 263/263, all fourteen browser suites green.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/server.js

@@ -878,6 +878,26 @@ app.get("/api/auth/methods", (req, res) => {
   });
 });
 
+/* Where the HoneyOS bar lives, if it is wanted at all.
+ *
+ * Served at runtime rather than baked into the build for two reasons. The image
+ * is pulled ready-made, so a value fixed at build time could never be changed
+ * from the .env afterwards. And a service worker caches whole responses,
+ * headers included — anything frozen into index.html stays frozen in the
+ * browser long after the server has moved on.
+ *
+ * The key is only handed out together with an origin: without a bar it has
+ * nothing to unlock, and it should not sit in the page for no reason. It buys
+ * the list of apps and nothing else. */
+app.get("/api/public/config", (req, res) => {
+  const origin = String(process.env.INKNOTE_HONEYBAR_ORIGIN || "").replace(/\/+$/, "");
+  res.json({
+    honeybar: origin
+      ? { origin, key: String(process.env.INKNOTE_HONEYBAR_KEY || "") }
+      : null,
+  });
+});
+
 /* The browser is sent to the provider from here rather than from the app, so
  * the app never has to know the issuer, the scopes or the redirect. */
 app.get("/api/auth/oidc/start", async (req, res) => {