[fix](trx-frontend-http): serve the band plan to every session

/bandplan.json needed the control role.  Route access is decided by
suffix for static assets — .js, .css, .png and so on — and ".json" is
not among them, so the band plan matched nothing and fell through to the
catch-all.  It is compiled into the binary and identical for every user,
so it is public now, like the rest of them.

Two things followed from that.  Read-only sessions never saw a band plan
at all.  And since the page asks for it during startup, the request can
land before the session is established: that 401 was swallowed by an
empty catch and never retried, which is why the allocations sometimes
only appeared after a manual reload.

So the client no longer hides the failure, retries once the auth gate
clears — which is exactly when a startup 401 becomes fixable — and
schedules a draw when the data lands, since the strip is painted from
the spectrum draw and a rig sitting between frames would stay blank.

The fixture can now refuse the first request the way the server did, and
the spectrum layout test holds the client to recovering from it.

Signed-off-by: Stan Grams <sjg@haxx.space>

src/trx-client/trx-frontend/trx-frontend-http/frontend/tests/spectrum-layout.mjs

@@ -125,3 +125,30 @@ try {
   await browser.close();
   await fixture.close();
 }
+
+// The band plan is fetched once at startup, which can land before the session
+// exists. It used to fail silently and never retry, so the allocations only
+// turned up if the operator reloaded the page by hand.
+const retryFixture = await startWebFixture({
+  spectrum: true,
+  bandplan: BANDPLAN,
+  bandplanEnabled: true,
+  bandplanUnauthorizedFirst: true,
+});
+const retry = await startBrowser(chromium);
+try {
+  await retry.page.setViewportSize({ width: 1600, height: 950 });
+  await retry.page.goto(retryFixture.origin, { waitUntil: "domcontentloaded" });
+  await retry.page.locator("#spectrum-panel").waitFor({ state: "visible" });
+  await retry.page.waitForTimeout(2000);
+  const strip = await retry.page.evaluate(() => {
+    const element = document.getElementById("spectrum-bandplan-strip");
+    return { segments: element.children.length, empty: element.classList.contains("bp-empty") };
+  });
+  assert.ok(strip.segments > 0,
+    "the band plan never arrived after its first request was refused");
+  assert.equal(strip.empty, false, "the strip is still showing its placeholder");
+} finally {
+  await retry.browser.close();
+  await retryFixture.close();
+}