Kept the prototype out of search engines in the Website service.

Services/Website/Sources/App/Extensions/App+Build.swift

@@ -64,6 +64,7 @@ func application(
             cacheControl: reader.cacheControl,
             compressionMinResponseSize: reader.compressionMinResponseSize,
             httpsRedirect: reader.httpsRedirect,
+            isIndexable: reader.isIndexable,
             rateLimit: reader.rateLimit,
             securityHeaders: reader.securityHeaders,
             // An unset origin leaves the pages without canonical URLs and language alternates, rather than
@@ -181,6 +182,7 @@ private func logger(
 ///   - analytics: the analytics tracker both pages embed, or `nil` to omit it.
 ///   - cacheControl: the cache-control directives applied to the served static files.
 ///   - compressionMinResponseSize: the minimum response body size, in bytes, before compression is applied.
+///   - isIndexable: whether search engines may index the site; while `false`, every response is marked `noindex`.
 ///   - httpsRedirect: the origin plain-HTTP requests are redirected to, and whether the forwarded-protocol header is trusted.
 ///   - rateLimit: the rate limit configuration, currently applied to no route.
 ///   - securityHeaders: the security headers applied to every response.
@@ -201,6 +203,7 @@ private func router(
     cacheControl: CacheControl,
     compressionMinResponseSize: Int,
     httpsRedirect: HTTPSRedirectMiddleware<AppRequestContext>.Configuration,
+    isIndexable: Bool,
     rateLimit: RateLimitMiddleware<AppRequestContext>.Configuration,
     securityHeaders: SecurityHeadersMiddleware<AppRequestContext>.Configuration,
     siteOrigin: String?,
@@ -241,6 +244,11 @@ private func router(
         await home.refresh(with: .init(from: listings))
     }
 
+    // Outermost, so the mark reaches redirects, errors, and served files alike.
+    if !isIndexable {
+        router.add(middleware: NoIndexMiddleware())
+    }
+
     router.addMiddleware {
         LogRequestsMiddleware(logLevel)
         SecurityHeadersMiddleware(