The /app mount and HTTP route ownership

/app is the container filesystem mount, not a public URL prefix. The images install their executable and common runtime material there:

Image	Entrypoint	Shared mounted material
neon-server	/app/neon	/app/public, /app/content, /app/templates
neon-server	/app/neon	/app/public, /app/content, /app/templates

Each executable supplies only its public brand routes to portal::bootstrap. The mounted application crate always owns these HTTP paths and every descendant:

• operational and public ingress: /health, /readyz, /version, /assets/*, /webhook/*, /docusign/*, /public/*, and /dioxus-demo;
• application and control surfaces: /app/*, /lawyer/*, /admin/*, /app/api/*, /auth/*, /mcp/*, and /docs/*;
• API documentation: /app/api and /app/api/openapi.json.

The brand-owned public routes are:

• Neon Law: /, /contact, /team, /team/{slug}, /blog, /blog/{slug}, /privacy, /terms, /robots.txt, /sitemap.xml, and /llms.txt;
• Neon: /, /foundation, /foundation/mission, /notations, /transparency/*, /workshops/*, /foundation/nebula/*, /events/*, /privacy, /terms, /robots.txt, /sitemap.xml, and /llms.txt.

This precedence is fail-closed, not merge order. Each brand declares every route it mounts; startup returns an error if an exact path or descendant overlaps a Navigator-owned prefix. A brand therefore cannot shadow data access, authorization, control, API, health, or protocol routes.