Control-plane web shell. Presentation app lands in FN-181; this container only terminates TLS-ready static + API proxy.