[grade=A] Register sec.sami dashboard in DashCaddy login-page map

Add 'sec' to the buildLoginPage pages map in sso-gate.js. Without it,
/api/v1/auth/login-page?service=sec returned 404 'Unknown service' — the
TOTP login page is built from a hardcoded per-service map, so adding sec
to services.json (runtime config, gitignored) alone was not enough.

sec needs no app-token (plain web app behind the TOTP gate): after
check-session verifies the session it redirects to /?direct=1, bypassing
the Caddy @needsAutoLogin loop.

Codex grade A (urn:ump:p3jkreyxpqikwt54uxgpl7sybkbsnklbs5kdonq5ejfqyh27udla).

dashcaddy-api/routes/auth/sso-gate.js

@@ -388,6 +388,16 @@ ft('chat').then(function(r){return r.text()}).then(function(t){
   fail('Auto-login unavailable. <a href="/web/">Open Emby manually</a> or '+authLink('re-authenticate at DashCaddy'),'API: '+JSON.stringify(j))
 }).catch(function(e){fail('Could not reach DashCaddy. <a href="/web/">Open Emby manually</a>','Error: '+(e&&e.message||'unknown'))})`
     },
+    sec: {
+      // sec.sami — fleet security dashboard. Unlike media apps it needs NO
+      // app-specific token: it's a plain web app behind the TOTP gate. The
+      // SHELL above has already verified check-session returned authenticated
+      // (otherwise it redirected to status.sami), so here we simply enter the
+      // dashboard. ?direct=1 bypasses the Caddy @needsAutoLogin redirect that
+      // sends bare "/" back to /dashcaddy-login, avoiding a loop.
+      title: 'Signing in to Security...', bg: '#070b10', accent: '#58a6ff',
+      body: `d.textContent='Session verified, opening dashboard...';go('/?direct=1');`
+    },
   };
 
   const cfg = pages[service];