fix: final review wave — public routes, inbox 419, url schemes, deep_link, tests

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BCrwHHnGCB5XH968Nxokqw

core/bootstrap/app.php

@@ -20,7 +20,7 @@ return Application::configure(basePath: dirname(__DIR__))
             'auth.source' => AuthenticateSource::class,
             'remote.user' => RemoteUser::class,
         ]);
-        $middleware->validateCsrfTokens(except: ['a/*', 'hooks/*']);
+        $middleware->validateCsrfTokens(except: ['a/*', 'hooks/*', 'me/heartbeat']);
     })
     ->withExceptions(function (Exceptions $exceptions): void {
         $exceptions->shouldRenderJsonWhen(