docs(website): add cross-component blast-radius review + /api/mobile facade (Phase 0)

Expand the API v2 plan to account for consumers beyond the browser and
insulate the Android app from version churn before the v2 work begins.

- Inventory the three v1 API consumers (browser, Android app, Discord bot)
  and map the cross-component contracts (site<->link, site<->mobile).
- Fix two concrete plan bugs: the public shard SSE stream must stay
  anonymous (logged-out browsers and the app's ShardStreamClient send no
  auth header), and the useShardFeed fetch-rewrite is admin-stream-only.
- Add "Phase 0 - the mobile facade": a version-agnostic /api/mobile
  namespace (a thin BFF delegating to current controllers behind pinned
  wire shapes), landed before v2 so the auth merge never touches the app.
- Note link/ is essentially out of scope (no PROTOCOL_VERSION bump), with
  the admin-stream allowlist split as the only shared seam.
- Resequence PRs (Phase 0 first) and gate v1 retirement on the pre-facade
  app fleet aging out via an app-version floor, not the web client.
- Add M11 to docs/android/PLAN.md: migrate the app to /api/mobile + ship
  the app-version floor, cross-referenced with the website plan's Phase 0.

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

android/PLAN.md

@@ -648,6 +648,11 @@ Guidelines:
 
 ## 6. Screen ↔ endpoint map
 
+> **Path note (M11):** endpoints below are written with their current `/api/v1`-relative paths. Under
+> **M11** the app moves onto the version-agnostic **`/api/mobile`** facade (a pure rename — same
+> shapes, same auth); these references update to `/api/mobile/**` when that migration executes. See
+> [`../website/API_V2_PLAN.md`](../website/API_V2_PLAN.md) § Phase 0.
+
 ### 6.1 Public content
 - **Home/Status** — `GET /public/status`, `GET /public/settings` (branding + maintenance banner).
 - **News hub** — `GET /public/posts/:category` (`news | five-on-friday | newsletter | screenshots`),
@@ -878,6 +883,34 @@ push, and Play (M6–M8) follow the designed app.
       under `/admin/wiki/*`). No backend routes added (they already accept bearer + re-check role);
       shard-write actions degrade gracefully when the sidecar is offline. Excluded: hero/CMS block
       editor, Discord-bot config, uo-link config, OAuth-provider setup.
+12. **M11 — Migrate to the version-agnostic `/api/mobile` facade** (post-v1; decided 2026-07-22).
+    Prerequisite for the website's API v2 work — see
+    [`../website/API_V2_PLAN.md`](../website/API_V2_PLAN.md) § Phase 0. Today the app hardcodes ~70
+    `api/v1/…` endpoints, the SSE stream path, and the SSO URLs, has **no version negotiation and no
+    force-update**, and calls a mix of mobile-only (`/auth/mobile/*`) and *shared* web routes
+    (`/auth/me/*`, `/public/*`, `/player/*`, `/admin/*`) — so it is directly coupled to v1 and would
+    break the day v1 is retired. The website introduces a stable, version-agnostic `/api/mobile`
+    facade (a thin BFF that delegates to the current controllers behind pinned wire shapes); this
+    milestone moves the app onto it **once**, after which the app is insulated from all internal
+    v1→v2→vN churn.
+    - **App repoint (this milestone's core):** drop the `api/v1/` and `auth/mobile/` prefixes and
+      re-point everything to `/api/mobile` — the ~70 Retrofit endpoints in `data/api/*.kt`, the
+      `STREAM_PATH` in `core/net/ShardStreamClient.kt`, and the SSO start/exchange URLs in
+      `core/auth/sso/SsoAuthManager.kt`. Pure rename; no behavior, auth-model, or token-shape change
+      (the app is already bearer). The public shard stream stays **anonymous** (no `Authorization`
+      header) under its `/api/mobile` path.
+    - **App-version floor (ships in this milestone):** the app sends an app-version header on every
+      request, and the website gains a server-side min-supported-version gate that can return a
+      "please update" response. Its first job is to let the shard **sunset the pre-facade app** so the
+      website can finally delete `/api/v1`; thereafter it is the in-band mechanism for any breaking
+      `/api/mobile` change (URL-path versioning is deliberately absent on the facade).
+    - **Rollout & ordering:** the facade + app must be **released and adopted before the website
+      begins its v2 auth-merge / domain-split work** (website PR 0a = facade + telemetry; PR 0b =
+      this app repoint + the version floor). The old, un-updated app keeps working against frozen
+      `/api/v1` until the version floor ages it out — at which point v1 is deletable.
+    - **Not in scope:** any new screen, any auth-flow change, any UI work. This is a networking-layer
+      rename plus the version-floor plumbing. Once landed, the endpoint paths throughout §6 read
+      `/api/mobile/**`; update this doc's references when the migration executes.
 
 ---