hardening(dashboard): restrict revalidate() server action to a closed set of allowed paths

[coderabbitai]

Summary

The revalidate server action in web/apps/dashboard/app/actions.ts currently accepts an arbitrary path string. Any authenticated user who knows (or guesses) the action ID can call it to thrash the Next.js Data and Router caches for any route they choose.

The existing auth check (getAuth() → userId) is the meaningful security boundary. This issue tracks a hardening step: replacing the free-form path parameter with a closed, validated set of revalidation targets.

Suggested approach

Replace the free-form path parameter with a discriminated union of allowed route keys, or split into dedicated per-call-site actions, and map internally to canonical paths before calling revalidatePath.

Context

• Raised in PR fix(dashboard): narrow public server action surface for cookies and revalidate #6062 (fix/server-action-no-auth) by @coderabbitai
• Assessed as non-blocking hardening (not a security fix) by @mcstepp
• Backlink: fix(dashboard): narrow public server action surface for cookies and revalidate #6062 (comment)

/cc @mcstepp

[linear-code]

ENG-2784