Public status page (issue

Unauthenticated — the token is the only credential, same shape as /feed/{token}. Served on its own host (STATUS_PAGE_URL), not under /api/v1; a request to this path on the API host 404s. Any method other than GET on this path (HEAD/POST/PUT/DELETE) also 404s, never 405. A token that doesn't match the pattern below gets the same 404 without a database lookup. Carries Age (seconds the served copy has aged at the origin) and Cache-Control: public, max-age=<N>, where N is the full freshness lifetime the view was cached under — 60 for a settled view, 5 for one where the live status currently disagrees with the open incident rows — never reduced by Age, since a cache already subtracts Age from max-age itself; both headers are computed the same way on the RSS/Atom/JSON/badge siblings below.