fix(configurator): hosted deployment phase deep links

[lweberru]

Proven hosted defect

Release 38981609020 passed all gates (114/114 model, 13/13 dialogue, 817 unit, 60 PostgreSQL, 308 browser, native contracts, immutable tag and deployment). Both actual API/Runner droplets verified exact source 10ab13c. Final hosted smoke nevertheless found /deployments/plan returned a real server 404: the Vite preview masked missing compiled-UI allowlist entries. That failed hosted receipt remains preserved.

Fix

• Explicitly serve existing preparation/plan/apply/history and workspace frontend routes through the API, without a wildcard fallback.
• Extend the actual API static-serving regression; preserve 401 session enforcement and unknown/API/auth/missing-asset 404s.
• Document frontend/API route parity and the development-server fallback test boundary.

Verification

• Regression before fix: expected 200, received 404.
• npm run check: 817 passed, 66 environment-dependent skips; source-bound Assistant facts unchanged.
• Actual local static API plus compiled UI: both desktop/mobile Apply flows passed, including direct Plan load, Apply reload, translated blockers and exact unchecked approval/UUID gates. All APIs intercepted; catalogue lookup safely stubbed; no execution mutation and no Apply click.

A fresh normal manual Development release and all five actual-host smoke cases are required before final completion. No production deployment or customer Apply.