feat(web): route unauthenticated root to /welcome, deep links to login

An unauthenticated visit to / now lands on the public /welcome page
instead of bouncing straight to Dex. Deeper guarded paths still redirect
to /auth/login so the post-login round-trip returns the visitor to the
page they asked for. isPublicPath runs first, so no redirect loop.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/web/oidc/oidc.go

@@ -161,11 +161,11 @@ func (d *DexAuth) Middleware(h http.Handler) http.Handler {
 		}
 		sid, ok := d.sessionID(r)
 		if !ok {
-			d.redirectToLogin(w, r)
+			d.redirectUnauthenticated(w, r)
 			return
 		}
 		if _, ok := d.sessions.get(sid, d.now()); !ok {
-			d.redirectToLogin(w, r)
+			d.redirectUnauthenticated(w, r)
 			return
 		}
 		d.sessions.refresh(sid, d.now().Add(d.sessionTTL)) // sliding refresh
@@ -269,6 +269,18 @@ func (d *DexAuth) handleLogout(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, loginPath, http.StatusFound)
 }
 
+// redirectUnauthenticated sends an unauthenticated visitor somewhere useful: the
+// bare root goes to the public landing page (/welcome), any deeper guarded path
+// goes to login so the post-login round-trip can return them to it. isPublicPath
+// has already let /welcome and /auth/* through, so this never loops.
+func (d *DexAuth) redirectUnauthenticated(w http.ResponseWriter, r *http.Request) {
+	if r.URL.Path == "/" {
+		http.Redirect(w, r, "/welcome", http.StatusFound)
+		return
+	}
+	d.redirectToLogin(w, r)
+}
+
 func (d *DexAuth) redirectToLogin(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, loginPath, http.StatusFound)
 }