Published dashboard's link-unfurl OG card (baked PNG)

The 1200x630 PNG baked at publish (A5-5) for the token-authenticated PUBLISHED view — the image link-unfurl crawlers (Slack / LinkedIn / iMessage) fetch off the page's og:image meta. Serves the stored bytes keyed by the published sequence (Dashboard.share['sequence'], set alongside the bake dispatch): a republish mints a fresh card under the next sequence, so the ETag is sequence-keyed and the og:image URL cache-busts on it. 404 when no card was baked — an OG bake never fails a publish (A5-3 degradation), so absence is a normal state and the crawler falls back to the app-shell meta. Unfurl surface auth (USER-APPROVED): serves for EVERY published dashboard, unauthenticated included — the card is cover text + theme, never data. Content routes (canvas/data/pdf/video) keep their gating.