merge(13): bring main forward — unblocks the crate's test build

The lane merged main at 0c4826f8, one commit before 0de67ca6 added
auth/auth_rationale to PortMapping's test constructors in prod_orchestrator.rs.
That left the lane unable to compile ANY test in the archipelago crate, which
is why 13-05 could not observe its 13 tests pass (window 19). Not a defect in
this phase's work — just staleness.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

# Conflicts:
#	core/archipelago/src/main.rs

core/archipelago/src/api/rpc/mod.rs

@@ -1,4 +1,5 @@
 mod analytics;
+mod appgate;
 mod ark;
 mod assistant_chat;
 mod auth;
@@ -94,6 +95,11 @@ pub struct RpcHandler {
     port_allocator: Arc<tokio::sync::Mutex<PortAllocator>>,
     pub session_store: SessionStore,
     login_rate_limiter: LoginRateLimiter,
+    /// Authentication in front of every app port. Built here rather than in
+    /// `server.rs` so it shares this handler's session store and login rate
+    /// limiter — an attacker must not get a fresh budget of password guesses
+    /// by moving from the dashboard to an app port.
+    pub(crate) app_gate: Arc<crate::appgate::AppGate>,
     endpoint_rate_limiter: EndpointRateLimiter,
     response_cache: ResponseCache,
     mesh_service: Arc<tokio::sync::RwLock<Option<crate::mesh::MeshService>>>,
@@ -158,6 +164,13 @@ impl RpcHandler {
             });
         }
 
+        let app_gate = Arc::new(crate::appgate::AppGate::new(
+            session_store.clone(),
+            auth_manager.clone(),
+            login_rate_limiter.clone(),
+            config.data_dir.clone(),
+        ));
+
         Ok(Self {
             config,
             auth_manager,
@@ -168,6 +181,7 @@ impl RpcHandler {
             port_allocator,
             session_store,
             login_rate_limiter,
+            app_gate,
             endpoint_rate_limiter,
             response_cache: ResponseCache::new(5),
             mesh_service: Arc::new(tokio::sync::RwLock::new(None)),