Public page defects for guests: /flow redirects to a /boards 404, doubled forge title suffix, JSON 404 on the releases page, slow openapi.json #6731

Public page defects (overnight audit 2026-10-27, anonymous GETs):

1. /flow → 301 → /boards → 404 "Not found · forge" for a signed-out visitor. Either /boards is public (fix the 404), or it's sign-in only, and then it redirects to /_plat/login?rd=/boards like /map and /releases do, and /flow keeps that behaviour. A dead redirect chain is never right.
2. Doubled title suffix: /search?q=… is "Search · forge · forge"; /trevato/forge/issues and /pulls double it too. One suffix, everywhere. Add a test that no page title contains "· forge · forge".
3. /trevato/forge/releases answers a JSON 404 where every other missing page gets the HTML 404. Either serve the releases page, or make the 404 HTML for a browser (Accept: text/html).
4. /contract/openapi.json takes about 2.2 s (204 KB). Cache the rendered document per version and serve it compressed; target under 300 ms.

Tests: a crawl test over the public routes as a guest checks for no dead redirect chains, single title suffixes, and HTML 404s for browsers. Files: src/http/server.ts, src/web/layout.ts, src/contract/served.ts, tests

Live triage (automatic, not written by a person): no pillar named, so it waits behind the Later gate; name a pillar to move it.