fix(stage-2): audit dashboard TS alignment + login UX

Closes 4 audit findings:

- Route TS interface now carries dispatch_mode (sync|async). Backend's
  shared::route::Route has had this since 0012_routes_dispatch_mode but
  the TS client silently always created sync routes and the list
  display dropped the field. Add a Dispatch select to the new-route
  form and an "ASYNC" badge in the route list.

- api.files.downloadUrl pointed to a never-registered backend endpoint.
  The dashboard's live Download button was hitting 405. Add the GET
  handler (AppFilesRead + FilesRepo::head + FilesRepo::get, Content-
  Disposition: inline) at the same path that delete already used.

- F-T-003: adminRequest's 401 handler called goto(login) without a
  recursion cap. If the login endpoint itself returned 401, the wrapper
  looped until browser nav limits. Track consecutive 401s within a 10s
  window and hard-reload to /login?reason=auth-loop after the third,
  showing the user an explanatory banner. Any 2xx resets the counter.

- Login flow now honors a ?returnTo= query parameter. adminRequest and
  the root layout both append the current location when redirecting to
  /login; the login page validates the value is a same-origin admin
  path (no open-redirect) and goto's there after successful sign-in.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/manager-core/src/files_api.rs

@@ -15,10 +15,12 @@
 
 use std::sync::Arc;
 
+use axum::body::Body;
 use axum::extract::{Path, Query, State};
+use axum::http::header::{CONTENT_DISPOSITION, CONTENT_LENGTH, CONTENT_TYPE};
 use axum::http::StatusCode;
 use axum::response::{IntoResponse, Json, Response};
-use axum::routing::{delete, get};
+use axum::routing::get;
 use axum::{Extension, Router};
 use picloud_shared::{AppId, Principal};
 use serde::{Deserialize, Serialize};
@@ -41,7 +43,7 @@ pub fn files_admin_router(state: FilesAdminState) -> Router {
         .route("/apps/{app_id}/files", get(list_files))
         .route(
             "/apps/{app_id}/files/{collection}/{file_id}",
-            delete(delete_file),
+            get(get_file).delete(delete_file),
         )
         .with_state(state)
 }
@@ -120,6 +122,48 @@ async fn list_files(
     }))
 }
 
+/// `GET /apps/{id}/files/{collection}/{file_id}` — stream the file's
+/// bytes inline. The dashboard's Download button hits this; the audit
+/// flagged the missing handler (callers were 405'ing). Metadata gives
+/// the Content-Type + Content-Disposition; bytes come from
+/// `FilesRepo::get` (which checksum-verifies on read).
+async fn get_file(
+    State(s): State<FilesAdminState>,
+    Extension(principal): Extension<Principal>,
+    Path((id_or_slug, collection, file_id)): Path<(String, String, String)>,
+) -> Result<Response, FilesApiError> {
+    let app_id = resolve_app(&*s.apps, &id_or_slug).await?;
+    require(
+        s.authz.as_ref(),
+        &principal,
+        Capability::AppFilesRead(app_id),
+    )
+    .await?;
+    let id = Uuid::parse_str(&file_id).map_err(|_| FilesApiError::NotFound)?;
+    let meta = s
+        .files
+        .head(app_id, &collection, id)
+        .await?
+        .ok_or(FilesApiError::NotFound)?;
+    let bytes = s
+        .files
+        .get(app_id, &collection, id)
+        .await?
+        .ok_or(FilesApiError::NotFound)?;
+    let disposition = format!(
+        "inline; filename=\"{}\"",
+        meta.name.replace('"', "").replace(['\r', '\n'], "")
+    );
+    let len = bytes.len();
+    Ok(Response::builder()
+        .status(StatusCode::OK)
+        .header(CONTENT_TYPE, meta.content_type)
+        .header(CONTENT_DISPOSITION, disposition)
+        .header(CONTENT_LENGTH, len)
+        .body(Body::from(bytes))
+        .expect("build files download response"))
+}
+
 async fn delete_file(
     State(s): State<FilesAdminState>,
     Extension(principal): Extension<Principal>,