routes: break out SystemBridgeRoutes
withApi: make Notice constructor overridable
server/response: html-escape location in body
seed: serve main UI from localhost

Trying to serve the UI from https:// means we can't access
local APIs on http://localhost. So instead we serve the
client on localhost (which just proxies the main server,
which is still all https).