✓ Static page served via CloudFront → S3 (OAC)
If you can read this, the CloudFront distribution, the private S3 origin, and the PingFederate front-door login are all working.
Placeholder build — the app team's SPA replaces the contents of
frontend/dist.