Phase 3 of #427. Supersedes the abandoned PR #303 (open since Apr 23,
mergeable: CONFLICTING).

On startup, seed DATA_ROOT/index.html, DATA_ROOT/.acl, and
DATA_ROOT/index.html.acl with a minimal landing page and public-read
ACLs. Skip-if-exists — operator files are never overwritten. Skipped
entirely in read-only mode so startup never mutates DATA_ROOT.

Landing page adapts to server mode:
- multi-user + IDP   → Create a pod / Sign in
- single-user + IDP  → Sign in
- both               → Docs link, version, mode, enabled-feature pills

ACLs are portable by construction now that #428 / #430 made
generatePublicReadAcl emit the resourceUrl verbatim. The seeded /.acl
uses path-only "/" so it matches the request host, not whichever
interface the server happened to bind on first start.

Carries over the design + Copilot review fixes from PR #303:
- generatePublicReadAcl reuse (no inline ACL JSON)
- skip in read-only mode
- check storage.write returns; abort ACL seeding on HTML write failure
- real IDP routes (/idp/register, /idp — not /.account/new, /idp/auth)
- full error logging (with stack)
- terminal feature flag
- resilient package.json read with version=unknown fallback
- restore process.env.DATA_ROOT after operator-override test

One additional fix flagged but not addressed on the original branch:
String.prototype.replace with a string interprets `$&`, `$1`, etc. as
substitution patterns, which would corrupt any interpolated value
containing `$` (notably a singleUserName). Switched all template
substitutions to the function form. Regression test asserts a
singleUserName of "foo$&bar" survives intact.

811/811 tests pass.

Address Copilot review on #434. The previous commit seeded /.acl with
generatePublicReadAcl('/') and /index.html.acl with
generatePublicReadAcl('/index.html'). Both work when JSS sits at the
origin root (the two coincide there), but '/' resolves to the origin
root regardless of any path prefix the server is mounted under — so
JSS behind a reverse proxy at e.g. https://example/jss/ would seed an
ACL whose accessTo points at https://example/ rather than
https://example/jss/.

Switch to './' / './index.html' (resolved against the .acl's own URL),
matching createPodStructure / createRootPodStructure since #428 / #430.

Add a regression test that inspects the on-disk .acl files directly
and asserts the relative form. A request smoke-test wouldn't catch
this since both forms work when mounted at the origin root.

812/812 tests pass.

Address Copilot review (2nd round) on #434. The previous chain of
sequential .replace() calls re-scanned already-substituted values,
so a singleUserName containing a literal `{{actions}}` would land
in `subtitle` and then get expanded by the later
`.replace(/{{actions}}/g, …)` — letting any pod owner inject other
template fragments via their name.

Switch to a single pass: build a values map, then run one
.replace(/{{(\w+)}}/g, (m, k) => values[k]) over the original
template. Each token is matched against `tpl` exactly once and
substituted from the map; substituted text is not re-scanned. Also
keeps the `$&` immunity (still using the function form of replace).

Regression test asserts a singleUserName of "evil{{actions}}name"
appears verbatim in the output and does not get the actions block
spliced in.

813/813 tests pass.