fix: only enter hosted-static mode for window-origin targets on bootstrap failure

The catch block in beforeLoad was treating every error from
ensurePrimaryEnvironmentReady() and resolveInitialServerAuthGateState()
as a signal to enter hosted-static mode. This meant desktop and
self-hosted deployments with an explicitly configured backend would
silently degrade to an empty app shell on transient failures, instead
of showing the error page with a 'Try again' button.

Now the catch checks the primary environment target source. Only when
the target is 'window-origin' (the fallback used by the hosted app at
app.t3.codes with no backend at the origin) does it enter hosted-static
mode. For 'desktop-managed' or 'configured' targets, the error
propagates to TanStack Router's errorComponent as before.

Author: cursoragent

apps/web/src/environments/primary/index.ts

@@ -32,4 +32,8 @@ export {
   __resetServerAuthBootstrapForTests,
 } from "./auth";
 
-export { resolvePrimaryEnvironmentHttpUrl, isLoopbackHostname } from "./target";
+export {
+  resolvePrimaryEnvironmentHttpUrl,
+  isLoopbackHostname,
+  readPrimaryEnvironmentTarget,
+} from "./target";

apps/web/src/routes/__root.tsx

@@ -55,6 +55,7 @@ import { configureClientTracing } from "../observability/clientTracing";
 import {
   ensurePrimaryEnvironmentReady,
   getPrimaryKnownEnvironment,
+  readPrimaryEnvironmentTarget,
   resolveInitialServerAuthGateState,
   updatePrimaryEnvironmentDescriptor,
 } from "../environments/primary";
@@ -81,7 +82,8 @@ export const Route = createRootRouteWithContext<{
         authGateState,
       };
     } catch (error) {
-      if (location.pathname === "/pair") {
+      const primaryTarget = readPrimaryEnvironmentTarget();
+      if (location.pathname === "/pair" || primaryTarget?.source !== "window-origin") {
         throw error;
       }