Temporary placeholder served from private S3 via CloudFront (OAC). Real content arrives with the frontend pipeline.