R3: split the landing into its own static container

- gateway/Dockerfile gains a `landing` target: caddy:2-alpine + the shared
  Vite build (identical build args keep the ui stage a single cached build);
  the gateway target drops landing.html from the embed.
- The contour caddy routes /app/, /telegram/ and the Connect path to the
  gateway; the catch-all — the landing at / and any stray path — goes to the
  new landing service, so junk traffic is absorbed by static file serving.
- deploy/landing/Caddyfile mirrors the webui caching (immutable assets,
  no-cache shells) and falls back unknown paths to the landing shell.
- The gateway's / now 308-redirects to /app/ (keeps a local no-caddy run
  usable); webui placeholder landing.html removed.
- CI deploy probe checks both / (landing) and /app/ (gateway).

Verified: both images build; the landing container serves landing.html at /
(no-cache) with junk-path fallback; the gateway image redirects / to /app/
and carries no landing content.

gateway/internal/connectsrv/server.go

@@ -158,14 +158,16 @@ func (s *Server) HTTPHandler() http.Handler {
 		// does not serve the app shell at the operator path.
 		mux.Handle("/_gm/", http.NotFoundHandler())
 	}
-	// The embedded UI: the game SPA under /app/ (web) and /telegram/ (the Telegram Mini
-	// App), with a separate landing page at the catch-all "/" — the single-origin model
-	// (docs/ARCHITECTURE.md §13). All sit below the h2c wrap so the Connect edge (a more
-	// specific prefix) keeps priority. Each SPA mount falls back to the app shell
-	// (index.html) for the hash router; "/" falls back to the landing (landing.html).
+	// The embedded UI: the game SPA under /app/ (web) and /telegram/ (the Telegram
+	// Mini App) — the single-origin model (docs/ARCHITECTURE.md §13). Both sit below
+	// the h2c wrap so the Connect edge (a more specific prefix) keeps priority, and
+	// each mount falls back to the app shell (index.html) for the hash router. The
+	// public landing moved to its own static container behind the contour caddy
+	// (R3), so the catch-all redirects a stray root hit to the app shell — which
+	// keeps a local no-caddy run usable.
 	mux.Handle("/telegram/", webui.Handler("/telegram/", "index.html"))
 	mux.Handle("/app/", webui.Handler("/app/", "index.html"))
-	mux.Handle("/", webui.Handler("", "landing.html"))
+	mux.Handle("/", http.RedirectHandler("/app/", http.StatusPermanentRedirect))
 	// Every request body on the public listener is capped (the admin proxy POSTs
 	// included); the h2c server carries explicit stream/idle sizing (R3).
 	return h2c.NewHandler(maxBodyHandler(s.maxBodyBytes, mux), &http2.Server{

gateway/internal/connectsrv/server_test.go

@@ -197,6 +197,26 @@ func TestExecuteOversizedPayloadRejected(t *testing.T) {
 	}
 }
 
+// TestRootRedirectsToApp verifies the gateway no longer serves a landing at "/"
+// (it lives in the landing container since R3): a stray root hit is redirected
+// to the app shell.
+func TestRootRedirectsToApp(t *testing.T) {
+	front := httptest.NewServer(connectsrv.NewServer(connectsrv.Deps{}).HTTPHandler())
+	defer front.Close()
+
+	client := &http.Client{CheckRedirect: func(*http.Request, []*http.Request) error {
+		return http.ErrUseLastResponse
+	}}
+	resp, err := client.Get(front.URL + "/")
+	if err != nil {
+		t.Fatalf("get /: %v", err)
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode != http.StatusPermanentRedirect || resp.Header.Get("Location") != "/app/" {
+		t.Fatalf("GET / = %d -> %q, want 308 -> /app/", resp.StatusCode, resp.Header.Get("Location"))
+	}
+}
+
 func TestExecuteUnknownMessageType(t *testing.T) {
 	client, cleanup := newEdge(t, func(w http.ResponseWriter, r *http.Request) {})
 	defer cleanup()