Use WireGuard access address for application and API links

network-ui.js

@@ -54,3 +54,17 @@ async function networkPage(){
  networkButtons();
  }catch(e){if(document.querySelector('#network-message'))document.querySelector('#network-message').textContent=e.message;}
 }
+
+/* Application links follow confirmed access policy, including SSH management views. */
+window.DeckLinks=(()=>{
+ let status=null,checked=0;
+ async function refresh(){
+  if(Date.now()-checked<5000)return;
+  try{status=await networkRequest('');checked=Date.now();}catch{} 
+ }
+ function url(port,path='/'){
+  const base=status?.enabled&&status?.mode==='tunnel'&&status?.tunnel_url?new URL(status.tunnel_url):new URL(location.href);
+  base.port=String(port);base.pathname=path;base.search='';base.hash='';return base.href;
+ }
+ return {refresh,url};
+})();