docs: add AgentOS dev server previews

[RivetAgent]

Summary

• add a Dev Servers workload guide for the code-generation loop
• show how to configure AgentOS preview link lifetimes
• show how to start a generated app's dev server, create a signed preview link, and revoke it
• clarify when to use private httpRequest() access and when to deploy the finished app with Dynamic Apps

Validation

• git diff --check
• parsed docs/sidebar.json with JSON.parse

Note: Biome ignores the docs MDX and sidebar JSON paths, so there is no repo formatter check for these files.

[railway-app]

This PR was not deployed automatically as @RivetAgent does not have access to the Railway project.

In order to get automatic PR deploys, please add @RivetAgent to your workspace on Railway.

[railway-app]

This PR was not deployed automatically as @RivetAgent does not have access to the Railway project.

In order to get automatic PR deploys, please add @RivetAgent to your workspace on Railway.

[the-company-company]

🟠 2 medium-severity findings

_{Reviewed commit d46a348.}

[the-company-company]

🟠 Medium · Configure the signed path as the dev server's public base

The server is started before the preview path is minted, so a conventional frontend cannot be configured for the /fetch/<token> prefix. For example, Vite's default HTML requests /@vite/client and /src/...; those requests omit the token prefix and hit the actor's non-preview route, which returns 404. Mint the preview first and pass preview.path as the framework's base/asset prefix when spawning the server, or explicitly limit this flow to applications whose asset URLs are relative.

[the-company-company]

🟠 Medium · Do not promise hot reload over an HTTP-only preview

The preview handler forwards each request through the buffered vm.network.httpRequest() API and has no WebSocket/Upgrade path. WebSocket-based HMR clients such as Vite's therefore cannot connect through this link, even if the page and assets are otherwise configured for the preview prefix. Scope this to HTTP previews and document manual refresh, or add WebSocket forwarding before advertising hot reload.