dashboard: path-containment and enrollment gates owed by the server slice #3122

What Four #2848 review findings must land with the dashboard slice that adds /api/datasets/labels and device_manager.py, not after it.

Where strands_robots/dashboard/server.py on main @ 55f38d17b; measured on dashboard-revamp @ 59fc905.

Evidence grep -rn "datasets/labels\|PUBLIC_PATHS" strands_robots/ is empty on main and dashboard/device_manager.py does not exist, so all four are still owed. On the branch the labels read does Path(root).expanduser() then is_dir() - existence, not containment - so any directory is readable and its 404 leaks whether a path exists; device_manager.py:999 repeats the shape.

Fix With those routes: resolve() + is_relative_to() against the dataset home on both reads; drop /api/auth/register/* from PUBLIC_PATHS or pin #3078's function-level gate as the sole defence and correct the comment claiming the set self-gates; raise instead of _drain's bare assert.

Done when Both reads refuse a path outside the dataset home, and a test names why the register paths are public or not.