Secure first-loop control-plane auth and mount routing.

Protect the control-plane API with explicit bearer auth, add node-scoped
registration/heartbeat credentials, and make export mount paths an explicit
contract field so mount profiles stay correct across runtimes.

Generated with [Devin](https://cli.devin.ai/docs)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

apps/nextcloud-app/lib/Controller/PageController.php

@@ -39,5 +39,21 @@ class PageController extends Controller {
 			],
 		);
 	}
-}
 
+	#[NoCSRFRequired]
+	#[NoAdminRequired]
+	#[OpenAPI(OpenAPI::SCOPE_IGNORE)]
+	#[FrontpageRoute(verb: 'GET', url: '/exports/{exportId}')]
+	public function showExport(string $exportId): TemplateResponse {
+		return new TemplateResponse(
+			Application::APP_ID,
+			'export',
+			[
+				'appName' => 'betterNAS Control Plane',
+				'controlPlaneUrl' => $this->controlPlaneConfig->getBaseUrl(),
+				'exportId' => $exportId,
+				'export' => $this->controlPlaneClient->fetchExport($exportId),
+			],
+		);
+	}
+}