Published dashboard's link-unfurl share page (crawler-facing HTML)

The server-rendered OG page a link-unfurl crawler scrapes when the published link is pasted into Slack / LinkedIn / iMessage: absolute og:*/twitter:* meta whose og:image is the baked /url/{url}/og-card PNG (cache-busted ?v={sequence}), plus a loop-guarded JS bounce that sends real browsers into the v3 viewer hash route. Carries ONLY the cover text (title + standfirst) — never canvas internals or data values, and on a board with row-level security on, not the standfirst either (it is verified against the whole-dataset bake, and a crawler has no scope to resolve): title + card only. Unfurl surface auth (USER-APPROVED): serves for EVERY published dashboard, unauthenticated included; 404 for unknown or unpublished tokens. v3-only: a v2 dashboard 409s on the cross-engine gate.