Openai Apps Challenge

Prove we control this host, for the ChatGPT app directory.

The token is served verbatim as plain text — OpenAI compares bytes, so a JSON wrapper or a trailing newline is a failed verification with no useful error.

Unset answers 404, not an empty 200. A blank body that matches nothing reads as "verification failed, cause unknown"; a 404 says plainly that no challenge is configured on this deploy.

Never cached: a stale token outlives the submission it belonged to, and re-verification would then compare against a value we have since rotated.