fix(dashboard): make the first launch honest and survivable on root-owned global installs

dashboard/package.json

@@ -8,7 +8,6 @@
     "start": "node server.js"
   },
   "dependencies": {
-    "express": "^4.18.2",
     "ws": "^8.16.0"
   }
 }

docs/ROADMAP.md

@@ -8,6 +8,7 @@ This document describes the planned development direction for EGC (Extended Glob
 - The two Windows-only crashes from the same v1.1.18 report fixed by their reporter (@Akisolu, first code PR): the `install.ps1` inline `node -e` that Windows PowerShell 5.1's quote-stripping turned into a SyntaxError now lives in a dedicated `scripts/lib/apply-commit-privacy.js`, and the crusher-shim printers normalize `installWindowsPath()`'s single-object result through a shared `toPathResultArray` helper covering install and uninstall alike, so `egc crusher-shim install|uninstall` no longer throws on Windows and labels the registry-backed PATH update honestly; tested end-to-end on a real Windows 10 / PowerShell 5.1 machine before and after review (#1229)
 - The new helper resolves the repo root from its own file location instead of `process.argv`, keeping externally influenced strings out of the git-config command it feeds, and the installer call drops the now-unused argument (#1230)
 - `egc install` run from the globally installed npm package no longer attempts `npm link` there: both installers resolve the `npm root -g` package directory and compare it (symlink-safe) with their own root first, announcing the skip when they match, so the misleading `npm link failed ... from this checkout` note the #1218 Linux report hit (Ubuntu 26.04, root-owned distro prefix, with a perfectly working `egc` bin regardless) is gone, while git checkouts and unpacked tarballs keep linking exactly as before (#1231)
+- The dashboard's first launch no longer dies silently on root-owned global installs (#1233, same Linux testing round): `express` joins the root dependencies (`ws` already was one) so the global install ships everything `dashboard/server.js` resolves, the on-demand `npm install` inside the package directory is gated on dependency resolution plus a writability check with an honest refusal (instead of npm's buried EACCES), and the init/install launcher now polls the detached server for readiness, opening the browser only when it answers and printing `EGC Dashboard did not start.` with the exact foreground command that reveals the real error when it does not (#1234)
 
 ## v1.1.18: Production Hardening (Released 2026-08-06)