This is a placeholder. The coverage matrix UI arrives with #8 and replaces this file; nothing in Kotlin needs to change when it does.
The API is already here and already authenticated:
/api/coverage, /api/properties,
/api/rate-rules and /api/me.
Every one of them refuses a request carrying no session.
This page is the one route besides /health and
POST /api/session that answers without a session, because it is
the page a person needs before they have one. Sign-in itself arrives
with #8.