User-agent: *
Allow: /
# Keeps the admin panel and the API out of search indexes. This is hygiene,
# not access control — the real gate is the session check.
Disallow: /admin
Disallow: /api