Add reuse service landing page

docs/s5-app-onboarding-checklist.md

@@ -64,6 +64,40 @@ workplans first.
   headers to a value included in the app's allowed hosts.
 - [ ] Keep readiness and liveness paths stable and unauthenticated.
 
+## Endpoint Landing Pages
+
+- [ ] Give every public S5 endpoint an intentional browser response at `/`.
+- [ ] For API-only services, serve a static informational landing page at `/`
+  that states the service purpose, avoids any login claim, does not expose or
+  hint at runtime secrets, and links only to non-secret health/status or
+  operator documentation.
+- [ ] For UI-backed services, a landing page may forward users to the canonical
+  login or application route, but it must also include a visible button for the
+  same destination.
+- [ ] Preserve existing machine-facing paths. Health probes, API prefixes,
+  OAuth callbacks, and static asset routes must continue to reach their owning
+  backend after the landing page is enabled.
+- [ ] For API-only endpoints, route explicit API/probe paths such as `/health`
+  and `/v1` to the API service, then use `/` as the landing fallback. Avoid
+  competing exact `/` and prefix `/` rules for different backends.
+- [ ] Add `noindex` metadata for operator and service landing pages that are
+  not intended as public marketing pages.
+
+Example UI-backed landing values:
+
+```yaml
+landing:
+  enabled: true
+  title: "Application sign-in"
+  eyebrow: "app.example.coulomb.social"
+  body: "You are being sent to the application sign-in page."
+  buttonLabel: "Continue to sign-in"
+  redirect:
+    enabled: true
+    target: "/login/"
+    delaySeconds: 5
+```
+
 ## Validation And Smoke Tests
 
 - [ ] Run `make check-tools`.
@@ -73,8 +107,8 @@ workplans first.
 - [ ] Use the persistent-pod plus `kubectl exec` smoke pattern from
   `docs/operator-recipes.md`.
 - [ ] Capture app-level deployment evidence: dry-run result, rollout status,
-  HTTPS or service smoke check, migration result when applicable, and rollback
-  note.
+  HTTPS or service smoke check, landing-page check when enabled, migration
+  result when applicable, and rollback note.
 
 ## Runbook Baseline
 
@@ -86,6 +120,7 @@ Each S5 app runbook should include:
 - day-to-day operator commands;
 - image promotion steps;
 - rollback behavior and migration warning;
+- public `/` landing-page behavior and the canonical login or API entrypoints;
 - troubleshooting for probes, database URLs, TLS, and app-specific failure
   modes;
 - backup and restore readiness gate;