MC-4897

## LIVE BREAKAGE MC's `/apps/<app_id>` page (`models.APPS`) serves the CEO / Portfolio / FinDash / Project-Intelligence dashboards from HARDCODED `~/workspace/PKA/dashboards/*.html` paths. The outputs→cloud migration removed those files from the Luci PKA checkout (git rm --cached + gitignore), so `GET /apps/ceo-dashboard` (and portfolio/findash/project-intelligence) now returns **HTTP 404**. Fresh versions are in the cloud at `PKA-Outputs/dashboards/` but MC was never repointed. Mirror the MC-4867 reports pattern: serve CLOUD-FIRST with the legacy path as fallback. ## Changes — mission-control/app.py - The `/apps/<app_id>` handler does `content = Path(app_def["path"]).read_text(...)`. Make it resolve CLOUD-FIRST: try `<cloud_dashboards_dir>/<basename(app_def['path'])>` first, then fall back to `app_def["path"]`. Cloud dir on Luci = `/home/lucienne/gdrive/PKA-Outputs/dashboards` (resolve via `python3 ~/workspace/PKA/pka_paths.py outputs-dir dashboards`, or import pka_paths.outputs_dir("dashboards")). - Apply only to internal apps whose path points under `.../PKA/dashboards/` (ceo-dashboard, portfolio, findash, project-intelligence — check models.APPS for the full list). Leave `external`/`internal_route` apps (smart-money, f1, price-watch, spotify-radio) unchanged. - Keep it traversal-safe: only swap the directory for the known app_def basename; do not read arbitrary user-supplied paths. ## Constraints - Non-breaking: cloud-first + legacy fallback. Guarded deploy (live control plane): `mc_orchestrator_deploy.py --apply --reload-mc` — but produce REVIEW-REQUIRED evidence; Lucienne (controller) does the guarded deploy. ## Verification (before review-required) - `GET /apps/ceo-dashboard`, `/apps/findash`, `/apps/portfolio`, `/apps/project-intelligence` → 200 (served from cloud, fresh size). External apps still redirect. Board `/` loads. app.py parses; tests pass. ## Terminal-state report REQUIRED: STATUS, 1-line, commit SHA, the literal /apps HTTP codes, follow-ups. Don't deploy live.