What to build: An unauthenticated visitor at the app's address sees the Catalogue browse page: title, subtitle, authors, publisher, year, language, tags, identifiers, read status, and cover images — browsable and searchable as today. They see no notes, no shelf locations, no wishlist, no scan photos, no timestamps, and no edit affordances anywhere. An authenticated household editor sees everything, unchanged.
Per ADR-0001 this must be fail-closed: the public data comes from its own endpoint that whitelists fields, not from filter flags on the private endpoints. Cover images remain publicly served; scan photos become private. If Disposition (ticket 04) has landed, disposed Volumes are excluded from the public payload.
Blocked by: 01 — Shared-password auth.
Status: done (commit c38d580, 2026-08-01)
covers; search and filters work over that payload
references, or timestamps (verified by test, field by field)
their endpoints refuse unauthenticated calls regardless