Refactor restricted app paths and naming.

passkey/fastapi/api.py

@@ -39,7 +39,7 @@ app.mount("/user", user.app)
 @app.get("/restricted")
 async def restricted_view():
     """Serve the restricted/authentication UI for iframe embedding."""
-    return FileResponse(frontend.file("restricted-api", "index.html"))
+    return FileResponse(frontend.file("restricted/api", "index.html"))
 
 
 @app.exception_handler(HTTPException)
@@ -155,7 +155,7 @@ async def forward_authentication(
         return Response(status_code=204, headers=remote_headers)
     except HTTPException as e:
         # Let global handler clear cookie; still return HTML surface instead of JSON
-        html = frontend.file("restricted", "index.html").read_bytes()
+        html = frontend.file("restricted/forward", "index.html").read_bytes()
         status = e.status_code
         # If 401 we still want cookie cleared; rely on handler by raising again not feasible (we need HTML)
         if status == 401: