P27F2 expected VM103 managed-source delta from a7425fdc00965072dca3da665e6d5df7b8a829cc:

  M etc/caddy/Caddyfile
  M etc/router-machine-git-source.conf
  A srv/wg-paid/access-web/assets/index-BLdWxCLP.css
  A srv/wg-paid/access-web/assets/index-CfBI-Ino.js
  A srv/wg-paid/access-web/index.html
  D srv/wg-paid/access-web/login.html
  D srv/wg-paid/access-web/magic.html

Functional delta:
  - deploy exact VM130-accepted P27F2 React/Vite access dist from web commit 96a9ebeef1608f26bfbbf0f21d4554789fb48983
  - serve /, /login, /invite, /auth/magic and /account from the same SPA index
  - serve only hashed /assets/* static files from the public access web root
  - replace access CSP inline allowances with script-src 'self' and style-src 'self'
  - preserve connect-src 'self' and the existing public auth/account API allowlist
  - public access host keeps /v2/admin/* and /v2/agent/* absent
  - no Node production server is introduced

Not changed:
  - VM121 backend/OpenAPI/schema/database
  - VM100/VM101 runtime, DNS, firewall or selector model
  - admin.secret-studio.ru vhost/body/TLS/network ACL
  - public API security meaning
  - reports vhosts

Machine Git profile note:
  legacy login.html and magic.html remain in MANAGED_PATHS as tombstones so the current generic engine can validate and commit their deletions; new hashed assets are admitted only by srv/wg-paid/access-web/assets/*.