feat(web): mount /welcome handler outside the auth guard

Wire GET /welcome on the root mux alongside /healthz, outside
Auth.Middleware. handleWelcome peeks the session via CurrentUser (no
redirect) and renders the logged-out or logged-in WelcomePage variant.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/web/handlers.go

@@ -83,6 +83,7 @@ func (a *App) logger() *slog.Logger {
 func (a *App) Router() http.Handler {
 	root := http.NewServeMux()
 	root.HandleFunc("GET /healthz", a.handleHealthz)
+	root.HandleFunc("GET /welcome", a.handleWelcome)
 	root.Handle("GET /static/", staticHandler())
 	root.Handle("/auth/", a.Auth.Routes())
 
@@ -117,6 +118,15 @@ func (a *App) Router() http.Handler {
 	return root
 }
 
+// handleWelcome renders the public landing page (/welcome). It is mounted outside
+// Auth.Middleware, so it must not assume a session: CurrentUser peeks the cookie
+// without redirecting and the page renders the logged-out or logged-in variant
+// accordingly.
+func (a *App) handleWelcome(w http.ResponseWriter, r *http.Request) {
+	user, ok := a.Auth.CurrentUser(r)
+	a.render(w, r, WelcomePage(user, ok))
+}
+
 // handleHealthz is the unauthenticated liveness/readiness probe.
 func (a *App) handleHealthz(w http.ResponseWriter, _ *http.Request) {
 	w.Header().Set("Content-Type", "text/plain; charset=utf-8")