[BUDI-9339] Fix App Scripts for public users - #19822

Description

App Scripts and their CSP whitelist entries were omitted for logged-out visitors, even when the workspace was licensed. Licensing ran before the workspace middleware created the public-user context.

Run licensing after workspace resolution so the existing script-rendering and CSP checks receive the resolved tenant's license for both public and authenticated users.

Validation:

• Four regression tests cover licensed and unlicensed visitors, both public and authenticated, including Head scripts, Body scripts, stylesheets, and CSP whitelist entries.
• All 51 static-route, workspace middleware, authentication, and user tests pass. Another 16 authorization and cross-tenant regression tests pass.
• ESLint and Prettier pass for the changed files.
• Browser verification confirms that the published public screen includes and executes its App Script with and without login cookies.
• Type checking reports two existing Koa request-body incompatibilities in packages/types/src/sdk/koa.ts.

Authentication still runs before workspace resolution, and route authorization remains afterward. Public requests now load the cached tenant license; the user quota check uses usageChange: 0.

Addresses

Fixes #16172

BUDI-9339

Screenshots

The recording shows a published Public user screen and its saved Head App Script, then the same published URL while logged in, after clearing all cookies, and after restoring login cookies. The script banner remains visible in each session. The bottom verification overlay reports the measured script/style tag counts and execution flag. Recorded on the local development stack with a development Enterprise license.

Launchcontrol

App scripts and styles now render for logged-out visitors on public screens when the workspace has the required license.