feat: bake a deploy-time server pin into the client via presetServer

web/js/app.js

@@ -9,6 +9,7 @@ import {
 } from "./proto.js";
 import * as store from "./store.js";
 import { connectStream } from "./transport.js";
+import { PRESET_SERVER } from "./config.js";
 
 const $ = (id) => document.getElementById(id);
 
@@ -912,6 +913,21 @@ async function rotateIdentity() {
 
 // --- boot --------------------------------------------------------------------------
 
+// A deployment MAY bake in a server key (the NixOS module's `presetServer`),
+// which only makes sense when whoever serves this page and whoever runs that
+// smolmaild are the same trusted party: the value arrives over this
+// deployment's own TLS, which is the trusted channel SPEC.md §4 asks a pin to
+// come from. This only seeds the first run — once written it is an ordinary
+// pin, editable and removable in settings like any other, and never
+// overwrites a host the user (or a previous boot) already pinned.
+function applyPresetServer() {
+  if (!PRESET_SERVER || store.serverPin(PRESET_SERVER.host)) return;
+  try {
+    store.pinServer(PRESET_SERVER.host, b32decode(PRESET_SERVER.publicKey));
+  } catch { /* malformed preset: leave unpinned rather than block boot */ }
+}
+
+applyPresetServer();
 applyTheme();
 store.identity() ? showApp() : showSetup();
 status(store.identity() ? "" : "create an identity to begin");

web/js/config.js

@@ -0,0 +1,7 @@
+// Deploy-time configuration, empty by default. A plain checkout (`devbox run
+// serve`) ships this file untouched, so PRESET_SERVER is null and nothing
+// below changes behavior. The nix package can overwrite this file at build
+// time with a real value — see nix/bridge.nix and the NixOS module's
+// `services.gsmol-bridge.presetServer` option.
+export const PRESET_SERVER = null;
+// Shape when set: { host: "example.org", publicKey: "base32-encoded-key" }