Share admin dashboard views through isolated read-only visitor access

docs/spectator-monitor.md

@@ -11,8 +11,8 @@ observed bot parties; guild goals and progress; confirmed social activity.
 Only autonomous bot-to-bot reply transcripts are public. Human conversations,
 whispers, memories, account/character IDs, tokens, configuration and PC telemetry
 are excluded. All text is rendered with textContent, never HTML interpolation.
-The HTTP service allows only explicit static paths and `/api/realm`, `/health`,
-`/robots.txt`. Mutation methods return 405; admin paths return 404.
+The HTTP service allows explicit public assets and read-only projections described
+below. Mutation methods return 405; administrative command paths return 404.
 
 ## Install and publish
 
@@ -58,3 +58,24 @@ After changing spectator source or assets, restart its service:
 ```sh
 systemctl --user restart azerothai-spectator
 ```
+
+## Shared dashboard (visitor edition)
+
+The public root now serves the application's `/visitor` route, which uses the
+same React dashboard and CSS as the administrator. Navigation, filters, profiles,
+recipe details and the world monitor remain usable. Editing forms and GM inputs
+are disabled; the action dispatcher also refuses writes in visitor mode.
+The public server independently rejects every mutation method, including server
+actions, and never proxies a viewer-selected backend route or request headers.
+
+`/api/state` is an explicit public projection shaped for the shared UI. Bot memory
+views contain confirmed shared social history, not private player conversations
+or operator-injected memories. The event stream is a polling view of that public
+history. `/api/health`, `/api/world-monitor` and `/api/operations` return selected
+read-only indicators. Native account identifiers, raw command queues, credentials,
+endpoint URLs and private maintenance logs are omitted. Built JavaScript/CSS/font
+assets are served from `dist/client` with traversal and source-map requests denied.
+
+Build with `pnpm build` before restarting `azerothai-runtime` and
+`azerothai-spectator`. The existing Funnel address and private admin address stay
+separate. No cache actions are added.