perf(watch): a shared link loads the player, not the app

A /watch link is opened by whoever it was sent to — signed out, often on a phone on mobile data —
and it booted through main.tsx: every app provider, the app's i18n (every locale of every area),
the flag sprites, ~392 KB gzip before the player could start. It now has its own HTML entry,
watch.html → watchMain.tsx, which imports WatchPage and what it renders; the server hands every
/watch/ path that page (the OG block injected as before), and vite dev does the same.

Measured on the build: /watch JS 290 → 87 KB gzip, CSS 104 → 19 KB; the app's own bytes unchanged.
Two leaks had to go for that: lib/format imported the app's i18n for one "just now" string (the
relative-time formatters now take `t`, like the file's other t-formatters), and the boundary's
crash copy came from the same i18n (CrashBoundary takes its copy; ErrorBoundary is the app's
wrapper, the watch entry gives it the page's own strings). The page's popover tree went too: it
renders no popover.

Held by: a contract test walking the entry's runtime imports, naming the path to anything only the
app may load (red on a planted i18n import in lib/format), and holding watch.html's head equal to
index.html's; a DB-lane test that every /watch/ path gets the player's page with the link's OG tags
and app paths get the app (red on the old routing). Screenshots at 375 px, EN and HU, video / audio /
password / gone / wrong password / unlocked: identical to the old entry's, bar the video's buffered bar.

frontend/vite.config.ts

@@ -1,4 +1,4 @@
-import { defineConfig } from "vite";
+import { defineConfig, type Plugin } from "vite";
 import { reactWithCompiler } from "./reactPlugin";
 import { devOnlyGuard } from "./devOnlyGuard";
 
@@ -17,8 +17,21 @@ const proxy = {
   "/healthz": proxyOpts,
 };
 
+// Two HTML entries: the app (index.html) and a public /watch/<token> link (watch.html), which loads
+// only the player page. In a build the backend picks the file by path (`main.py`); this does the
+// same for `vite dev`, whose history fallback would otherwise hand /watch/… the app.
+const watchEntry = (): Plugin => ({
+  name: "siftlode-watch-entry",
+  configureServer(server) {
+    server.middlewares.use((req, _res, next) => {
+      if (req.url?.startsWith("/watch/")) req.url = "/watch.html";
+      next();
+    });
+  },
+});
+
 export default defineConfig({
-  plugins: [reactWithCompiler(), devOnlyGuard()],
+  plugins: [reactWithCompiler(), devOnlyGuard(), watchEntry()],
   server: { port: 5173, proxy },
-  build: { outDir: "dist" },
+  build: { outDir: "dist", rollupOptions: { input: ["index.html", "watch.html"] } },
 });