QA fixes: HEAD on page routes, Shorts signed-out 401, invite-page onboarding handoff, viewer check buttons clear of the overlay close button

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

public/assets/join.js

@@ -40,7 +40,7 @@
   $('jnVerify').addEventListener('click', busy($('jnVerify'), async () => {
     await api('/api/auth/email/verify', { email: $('jnEmail').value, code: $('jnCode').value, newsletter: !!$('jnNews').checked, followups: !!$('jnNews').checked });
     IAP.status('You are in. Taking you to your dashboard…', 'ok');
-    location.href = '/my';
+    location.href = '/my?welcome=1'; // dashboard runs the username step + welcome tour on arrival
   }));
   $('jnEmail').addEventListener('keydown', e => { if (e.key === 'Enter') ($('jnVerify').hidden ? $('jnSend') : $('jnVerify')).click(); });
   $('jnCode').addEventListener('keydown', e => { if (e.key === 'Enter') $('jnVerify').click(); });

public/assets/my.js

@@ -476,6 +476,15 @@
     if ($('mcFinish')) $('mcFinish').hidden = !walletOnly;
     if (!signedIn) return;
     if ($('adminLink')) $('adminLink').hidden = !me.isAdmin; // admin portal link, only for ADMIN_EMAIL
+    // arrived from an invite page: run onboarding once (username, welcome tour, login ad)
+    if (/[?&]welcome=1/.test(location.search) && !render.welcomed) {
+      render.welcomed = true;
+      history.replaceState(null, '', '/my' + (location.hash || ''));
+      (async () => {
+        try { if (!me.username) await showOnboard(); if (!(await showGauntlet())) await showLoginAd(); } catch (e) {}
+        await render();
+      })();
+    }
     setPane(location.hash.slice(1) || 'overview');
     $('campGate').hidden = !!me.memberId;
     $('earnGate').hidden = !!me.memberId;

public/assets/shorts.js

@@ -13,7 +13,9 @@
     st.token = null; st.maxSeen = 0; st.credited = false; st.done = false;
     $('shOver').hidden = true; $('shCta').hidden = true; $('shNext').hidden = true;
     let r = null;
-    try { r = await j('/api/my/videos?orientation=portrait'); } catch (e) {}
+    // signed-out visitors get the sign-in note without a 401 round trip
+    let me = null; try { me = await j('/api/me'); } catch (e) {}
+    if (me && me.signedIn && me.email) { try { r = await j('/api/my/videos?orientation=portrait'); } catch (e) {} }
     if (!r || r.error) { $('shVideo').hidden = true; $('shMsg').hidden = false; $('shMsg').textContent = 'Sign in on the dashboard to watch shorts and earn.'; return; }
     $('shStat').textContent = 'today: ' + (r.status.count || 0) + ' / ' + r.status.cap;
     if (!r.ad) {