The front page: the forge featured with its crew at work, the best public apps ranked by real signals, and the owner pins and hides #686

Pillar: P2 Explorer (umbrella #588). Extends, does not duplicate, #607 (/explore): this is the signed-out front page, and it ranks with the same signals.

Outcome (what a stranger sees). One path: a stranger arrives, sees the forge and a few live apps, opens one or signs in.

• A featured slot at the top that the owner controls: by default this forge's own repository once it is public, until then the owner's first public pin. It shows what makes a forge different: the crew working on it right now.
• A short shelf of the best of what is public, each with a sharp picture taken as a stranger sees the app (#684), never a broken image or an empty box. Not one owner's apps: ranked by real signals already in the database (use, recent ships, forks, likes once #602 lands), with at most two per owner near the top. The rest is one link away (/apps).

Owner control. Pin (ordered), hide, and choose the featured repository:

• Page: /front, the front page as a stranger sees it; signed in as a site admin, each tile carries pin / hide / move controls. Linked from the studio home for admins.
• API: GET /api/v1/front (what a stranger is shown), PUT /api/v1/front {pinned, hidden} (site admin).
• MCP: front_page (read; with pinned/hidden, set, site admin only).

Safety. Nothing private is ever shown, even if pinned (a private pin is skipped until the repository is public). No spend, no wake, bounded grouped reads only.

Done means reachable: the page, the API and MCP paths, tests (ranking order on a fixture, two per owner, private pin skipped, a plain member and a stranger refused on the setting), and looks at phone and desktop width on the pull.