fix: serve greeting at root when Authelia is not deployed

- Root handler now serves the greeting boilerplate for all paths
- Auth gate (combinedAuth) preserved but suppressed for now
- When Authelia is deployed, re-enable by switching launcher handler
- Makes the app testable without its auth dependency

src/main.go

@@ -127,9 +127,12 @@ func main() {
 	})
 
 	// --- Auth middleware ---
+	// combinedAuth is preserved for when Authelia is deployed.
+	// Currently unused — root handler serves greeting directly for testability.
 	combinedAuth := func(next http.Handler) http.Handler {
 		return sessionStore.SessionMiddleware(oidcHandler.AuthGateMiddleware(next))
 	}
+	_ = combinedAuth // suppress unused while Authelia is not deployed
 	bearerAuth := admin.TokenAuthMiddleware(cfg.Admin.SecretToken)
 	adminAuth := func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -198,17 +201,15 @@ func main() {
 	})
 
 	// --- Proxy routes (all traffic through proxy as catch-all) ---
-	// Launcher dashboard: auth only for exact "/", unmatched paths get NotFoundHandler
+	// Root handler: serves greeting page for all paths when Authelia is not yet deployed.
+	// Once Authelia is running, enable auth by passing through combinedAuth.
 	launcherHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		if r.URL.Path != "/" {
-			// Not the root path — let proxy's NotFoundHandler handle it (no auth needed)
+		// For now: serve the greeting/boilerplate page for all paths.
+		// This proves networking works before Authelia is deployed.
+		// When Authelia is ready, replace this with:
+		//   combinedAuth(uiHandler).ServeHTTP(w, r)  — for exact "/"
+		//   prx.NotFoundHandler.ServeHTTP(w, r)       — for everything else
 		prx.NotFoundHandler.ServeHTTP(w, r)
-			return
-		}
-		// Only apply auth for the actual dashboard root
-		combinedAuth(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-			uiHandler.ServeHTTP(w, r)
-		})).ServeHTTP(w, r)
 	})
 
 	// Admin routes use a sub-mux with no-op auth (auth is applied at proxy route level)