feat(web): stealth-route /cms/* — return 404 to unauthorized callers

Any /cms/* hit (including exact /cms) that fails authorization returns
404 instead of redirecting to /account/login. CMS-PLAN §3.4 constraint.

DeepDrftWeb/Middleware/CmsStealthRoutingHandler.cs

@@ -0,0 +1,34 @@
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization.Policy;
+
+namespace DeepDrftWeb.Middleware;
+
+/// <summary>
+/// Returns 404 for any /cms/* request that fails authorization.
+/// This prevents the CMS from acknowledging its own existence to unauthorized callers
+/// (a redirect to /account/login would reveal that the route exists).
+/// CMS-PLAN §3.4 stealth-routing constraint.
+/// </summary>
+public class CmsStealthRoutingHandler : IAuthorizationMiddlewareResultHandler
+{
+    private readonly AuthorizationMiddlewareResultHandler _default = new();
+
+    public async Task HandleAsync(
+        RequestDelegate next,
+        HttpContext context,
+        AuthorizationPolicy policy,
+        PolicyAuthorizationResult authorizeResult)
+    {
+        // For /cms/* routes (including an exact /cms hit), map any authorization
+        // failure to 404 regardless of cause (unauthenticated, wrong role, or any
+        // future policy failure). This prevents the CMS from acknowledging its
+        // own existence to callers outside the Admin hierarchy.
+        if (context.Request.Path.StartsWithSegments("/cms") && !authorizeResult.Succeeded)
+        {
+            context.Response.StatusCode = StatusCodes.Status404NotFound;
+            return;
+        }
+
+        await _default.HandleAsync(next, context, policy, authorizeResult);
+    }
+}

DeepDrftWeb/Program.cs

@@ -2,6 +2,8 @@ using AuthBlocksLib;
 using AuthBlocksLib.Options;
 using DeepDrftCms;
 using DeepDrftWeb;
+using DeepDrftWeb.Middleware;
+using Microsoft.AspNetCore.Authorization;
 using MudBlazor.Services;
 using DeepDrftWeb.Components;
 using Microsoft.AspNetCore.HttpOverrides;
@@ -64,6 +66,11 @@ builder.Services.AddAuthBlocks(options =>
     };
 });
 
+// CMS stealth routing: unauthorized /cms/* requests return 404, not a redirect.
+// This prevents the CMS from revealing its own existence to unauthenticated callers.
+// See CMS-PLAN §3.4.
+builder.Services.AddSingleton<IAuthorizationMiddlewareResultHandler, CmsStealthRoutingHandler>();
+
 // AuthBlocksWeb: Blazor JWT client services (auth API is mounted on this same host via MapAuthBlocks).
 // AuthBlocksWeb.Startup.ConfigureAuthServices registers AddCascadingAuthenticationState server-side.
 AuthBlocksWeb.Startup.ConfigureAuthServices(builder.Services, baseUrl);