feat(mindspace): enforce PostgreSQL user data delivery

mindspace-page-sync.mjs

@@ -213,16 +213,23 @@ export async function syncGeneratedPagesFromPublicAssets({
   userId,
   publishDir = null,
   syncWorkspaceAssets = null,
+  onlyRelativePaths = null,
 } = {}) {
   if (!pool || !pageService || !userId) {
     return { created: 0, skipped: 0, updated: 0 };
   }
 
   if (typeof syncWorkspaceAssets === 'function') {
-    await syncWorkspaceAssets(userId, { categoryCode: 'public' }).catch(() => {});
+    await syncWorkspaceAssets(userId, {
+      categoryCode: 'public',
+      onlyRelativePaths,
+    }).catch(() => {});
   }
 
   const indexedPages = await loadIndexedWorkspacePages(pool, userId);
+  const allowList = onlyRelativePaths == null
+    ? null
+    : new Set(onlyRelativePaths.map((item) => normalizePublicHtmlPath(item)).filter(Boolean));
   let created = 0;
   let updated = 0;
   let skipped = 0;
@@ -230,6 +237,7 @@ export async function syncGeneratedPagesFromPublicAssets({
   if (publishDir) {
     const htmlFiles = await listPublishPublicHtmlFiles(publishDir);
     for (const file of htmlFiles) {
+      if (allowList && !allowList.has(file.relativePath)) continue;
       try {
         const content = await fs.readFile(file.absolutePath, 'utf8');
         if (!content.trim()) {
@@ -285,6 +293,7 @@ export async function syncGeneratedPagesFromPublicAssets({
         ? asset.original_filename
         : `public/${asset.original_filename}`,
     );
+    if (allowList && !allowList.has(relativePath)) continue;
     if (indexedPages.has(relativePath)) {
       skipped += 1;
       continue;