feat: add public h5 dashboard and publish traceability

.project-docs/10-decisions/ADR-005-public-read-only-h5-dashboard.md

@@ -0,0 +1,29 @@
+# ADR-005: Public Read-Only H5 Dashboard
+
+## Status
+
+Accepted — 2026-08-03
+
+## Context
+
+ARR Web login protects Finance operations, but the mobile H5 dashboard is a read-only aggregate view intended for
+broader viewing. Making only the HTML page public would leave its data requests behind the login gate. Making generic
+desktop APIs public would widen access to jobs, traces, operational health, filenames and other operator data.
+
+## Decision
+
+1. Publish the H5 page/assets anonymously.
+2. Add purpose-built anonymous `GET /api/public/h5/months` and `GET /api/public/h5/analytics` routes.
+3. Return only aggregate dashboard data and month/date coverage from those routes; omit source hashes, filenames,
+   traces, detailed health, source coordinates, guest/detail rows and operational metadata.
+4. Keep desktop pages, generic and legacy APIs, jobs/traces, downloads, uploads, Booking/company/report operations and
+   mutations behind the existing server-side session/CSRF boundary.
+5. Keep `/healthz` as the only public readiness signal; public JSON responses remain `no-store`.
+
+## Consequences
+
+- Anyone with the H5 URL can view the aggregate channel/room dashboard and all month options returned by the public H5
+  month index.
+- Finance/operator workflows remain authenticated and the public H5 surface has no write capability.
+- Deployment must treat the aggregate metrics, channel names and financial totals as intentionally public data and should
+  apply normal HTTPS, access logging and rate/abuse controls at the edge.