Baseline the by-host branding endpoint

Shipped

September 4, 2026 at 12:34 AM UTC

Author

Kamo

Commit

faa552b

**************** refused /org/public/by-host/{host}, which is exactly its job — a new mapping that resolves no session is reachable without credentials through APIService's /api/security/** relay. It is genuinely public, for the same reasons its sibling #branding already is, and it shares that sibling's private respond() method so there is one decision about what a guessable reference may expose rather than two that can drift.