fix(quality): the E2E front-controller gate blocked every app without an index route

[rubenvdlinde]

What was wrong

The Playwright job's pre-flight proved the php -S front controller was routing by requesting /apps/<app-name>/ and hard-failing on 404. That conflates two independent properties:

1. does the front controller route pretty URLs — a CI concern, and
2. does THIS app have an index route — an app design choice.

A settings-only app has no / route and no navigation entry, so /apps/<app>/ is a correct Nextcloud 404. The gate read that as a broken router, exited 1 before a single spec ran, and printed an error naming php -S.

ConductionNL/nldesign#206 hit exactly this: 31 specs that navigate to /settings/admin/theming never executed, and the failure text pointed at the wrong thing.

Evidence the two are separable

On that same PR, run 30859016722 (job 91836768845), the identical URL returned HTTP 500, not 404 — index.php had executed and thrown on a missing cross-app class. Same router, same request, different status. A 404 from /apps/<app>/ is therefore Nextcloud answering "no such route", not php -S answering "no such directory index".

The fix

Probe /apps/files/ instead. php -S 404s a path that resolves to a real directory with no index.php inside it — that is the entire failure mode the router exists to fix. apps/files is shipped, always enabled, has no index.php, and its route always resolves (302 to /login unauthenticated, never 404).

Measured on a fixture with and without the router. Note that the obvious alternatives are dead probes — a router-less php -S already serves them from the root index.php, so they would pass while the router was missing:

probe	no router	with router	discriminates?
/apps/files/	404	200	✅
/apps/<app>/	404	200	✅ but a 404 is also legitimate
/login	200	200	❌ dead probe
/nonexistent/	200	200	❌ dead probe

/apps/<app-name>/ is still requested and its status still printed — as a ::notice:: rather than a gate. A page app that lost its route and a settings-only app that never had one look identical from here, and only the spec run can tell them apart.

Not done

• No assertion weakened, no test skipped, no timeout raised, no allow-list widened. The OCS entry-point gate immediately below is untouched.