## Description
List static HTML outputs alongside registered apps in Craft's Apps tab.
Open these files without registering a webapp or starting a server.
Matching cards use aligned icons and left-aligned labels in a centered
column.
Serve relative pages, styles, scripts, images, and data through a
bounded, expiring folder capability. Each read checks the owner's
access. Isolated frames cannot access the parent application. Cached
assets speed repeat navigation; reload creates a fresh preview.
Apps reload refreshes both discovery and file inventory, with distinct
loading, incomplete, and error states. Uploaded HTML resets on explicit
reload even when its bytes are unchanged. Hidden frames retain
interactive state within the panel's bounded viewer cache.
Nginx preserves the incoming host and port for scoped preview policies.
Transient refresh failures retain the loaded frame. Mounted frames renew
their existing capability even when hidden, preserving page state. If
browser suspension lets it expire, the next fetch obtains a fresh grant.
Asset bytes are shared by tenant, session, path, and revision; access
checks remain per grant.
## How Has This Been Tested?
- Follow-up: 205 frontend tests, 26 backend tests, and CLI
deployment-file tests pass. Chromium verified mapped-port nginx data
fetches, modules, styles, navigation, and parent isolation.
- 66 panel, Apps, and file-preview tests passed; an additional HTML test
verifies scoped URLs and reload.
- Earlier static-preview verification passed 19 backend tests and
browser checks for relative assets, navigation, and parent isolation.
- Type checking, coverage, formatting, lint, and feature-map checks
passed.
## Additional Options
- [ ] [Optional] Please cherry-pick this PR to the latest release
version.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
<!-- coderabbit-ai-generated:v1 -->
## Summary by CodeRabbit
* **New Features**
* HTML and HTM files in Outputs now appear alongside web apps in Apps.
Select a file to open it in a preview tab, including pages that use
relative assets.
* Previews support refresh and automatically renew access. If a preview
can’t be loaded, you can retry or download the file.
* HTML previews run in a restricted viewer that limits access to other
content and blocks actions such as opening popups or submitting forms.
* **Bug Fixes**
* Proxy requests now preserve the incoming hostname and port.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Wenxi