Entry point for an agent that has the hostname and nothing else.

GET / was a 404, which is a dead end: the discovery documents all exist but you had to already know their paths to find them. Every URL below is a document that was already being served, so this adds a way in and no new surface. Unauthenticated by design, and it reveals nothing that /.well-known does not.

The API catalogue and auth.md live on the public site, not here, because that is the origin that publishes the agent-facing set. One copy, linked from both.