Serve the main dashboard. Generates a per-request CSP nonce, stashes it on request.state.csp_nonce so middleware/headers.py can echo it into the SPA style-src directive, and substitutes the __OL_CSP_NONCE__ placeholder in dashboard.html's inline <style> tag with that same value. Both halves of the nonce contract land together — if either is missing, the inline critical-CSS block won't apply and the page renders unstyled.

Injects browser Sentry DSN inline when SENTRY_DSN_BROWSER is configured so frontend error tracking works without an extra boot fetch.

S55 (2026-04-28): anonymous landings on the BARE root URL (no query string) used to 302-redirect to /welcome. 2026-04-30 GSC audit fix: inline-render the welcome content at / instead so Googlebot stops classifying / as a redirector ("Page with redirect" was 1 of 3 such GSC warnings). Both / and /welcome now render the same content for anon visitors, with <link rel="canonical" href="/"> in the template so Google indexes / and treats /welcome as alias. Auth users still get the dashboard at /; anon-with-query-string still gets the SPA so deep-link intent is preserved.