Add SPA static serving and open CORS for Tailscale access

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/api.py

@@ -12,7 +12,8 @@ sys.path.insert(0, str(Path(__file__).parent.parent))
 
 from fastapi import FastAPI, HTTPException, Query
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import JSONResponse
+from fastapi.responses import JSONResponse, FileResponse
+from fastapi.staticfiles import StaticFiles
 from pydantic import BaseModel
 
 from core.db import init_db
@@ -28,7 +29,7 @@ app = FastAPI(title="Kin API", version="0.1.0")
 
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["http://localhost:5173", "http://127.0.0.1:5173"],
+    allow_origins=["*"],
     allow_methods=["*"],
     allow_headers=["*"],
 )
@@ -414,3 +415,20 @@ def bootstrap(body: BootstrapRequest):
         "decisions_count": len(decisions) + len((obsidian or {}).get("decisions", [])),
         "tasks_count": len((obsidian or {}).get("tasks", [])),
     }
+
+
+# ---------------------------------------------------------------------------
+# SPA static files (AFTER all /api/ routes)
+# ---------------------------------------------------------------------------
+
+DIST = Path(__file__).parent / "frontend" / "dist"
+
+app.mount("/assets", StaticFiles(directory=str(DIST / "assets")), name="assets")
+
+
+@app.get("/{path:path}")
+async def serve_spa(path: str):
+    file = DIST / path
+    if file.exists() and file.is_file():
+        return FileResponse(file)
+    return FileResponse(DIST / "index.html")