fix(native): the app's browser sign-in no longer lands on the dashboard when the browser still holds an older TREK

A browser that ran TREK before 5.1.1 keeps that version's app in its service
worker. When the app opened /native-handoff, the worker answered it from its
cache with an app that has no such page, which sent the user to /, and the
sign-in ended on the dashboard in the browser instead of in the app.

The app now opens /api/auth/native/start, which every TREK service worker
passes to the server. That page takes the workers off the browser and
forwards to the handoff page. Until the sign-in is handed back, the web app
registers no service worker and does not reload for a new version: a tab
still open on the older TREK keeps its worker alive, and a registration or a
reload in the middle of the sign-in brought it back to answer the next page.

client/src/native/browserSignIn.ts

@@ -21,6 +21,13 @@ import { APP_URL_SCHEME, TrekShell } from './trekShell';
 
 export const HANDOFF_PATH = '/native-handoff';
 
+/**
+ * Where the browser is sent first: a page of the server's that takes an older
+ * TREK's service worker off the browser and then opens HANDOFF_PATH with the
+ * same query. Under /api, which every TREK service worker passes to the server.
+ */
+export const HANDOFF_START_PATH = '/api/auth/native/start';
+
 /** Where the browser starts: straight into SSO, or straight at the passkey prompt. */
 export type BrowserSignInStart = 'oidc' | 'passkey';
 
@@ -65,7 +72,7 @@ export function createHandoffSecret(): { verifier: string; challenge: string } {
 }
 
 export function handoffUrl(origin: string, challenge: string, start?: BrowserSignInStart, invite?: string): string {
-  const url = new URL(HANDOFF_PATH, origin);
+  const url = new URL(HANDOFF_START_PATH, origin);
   url.searchParams.set('challenge', challenge);
   if (start) url.searchParams.set('start', start);
   if (invite) url.searchParams.set('invite', invite);