fix: opax root + remove redundant auth routes

* chore(docs): set region to us-central1 in AGENT_RULEBOOK

* docs: update region references europe-west1 -> us-central1

* chore(scripts): update opax/opax2 comments to us-central1

* fix(main): use opax.html root and remove IAP-handled auth routes

main.py

@@ -29,7 +29,6 @@ from ml.telemetry import log_dag_execution
 from ml.billing_agent import BillingAgent
 from agents.aws_billing_agent import AWSBillingAgent
 from ml.anomaly_detector import AnomalyDetector
-from auth.oauth_flow import get_authorization_url, exchange_code_for_token
 from auth.token_store import save_token
 
 
@@ -138,8 +137,7 @@ class BudgetUpdateRequest(BaseModel):
 @app.get("/")
 def root():
     """Serves the main landing page."""
-    # This will be updated in a later step to a proper landing page
-    return FileResponse("static/command-hub.html")
+    return FileResponse("static/opax.html")
 
 
 # ── HEALTH ────────────────────────────────────────────────────────────────────
@@ -159,49 +157,6 @@ def service_worker():
 
 
 # ── AUTH — User Authentication ──────────────────────────────────────────
-@app.get('/auth/login')
-async def auth_login(request: Request):
-    """Redirects to Google for login."""
-    redirect_uri = request.url_for('auth_callback')
-    return await oauth.google.authorize_redirect(request, redirect_uri)
-
-@app.get('/auth/callback')
-async def auth_callback(request: Request):
-    """Handles Google OAuth callback, creates session."""
-    try:
-        token = await oauth.google.authorize_access_token(request)
-        user = token.get('userinfo')
-        if user:
-            email = user.get('email')
-            if not ALLOWED_EMAILS or email in ALLOWED_EMAILS:
-                request.session['user'] = dict(user)
-            else:
-                request.session.clear()
-                # Redirect to a "not authorized" page or show an error
-                return JSONResponse(
-                    status_code=403, 
-                    content={"error": f"Access denied for {email}. Please contact your administrator."}
-                )
-    except Exception as e:
-        print(f"Error during auth callback: {e}", file=sys.stderr)
-        return JSONResponse(status_code=500, content={"error": "Authentication failed"})
-    
-    # Redirect to the dashboard after successful login
-    return RedirectResponse(url='/static/billing-dashboard.html')
-
-
-@app.get('/auth/logout')
-async def auth_logout(request: Request):
-    """Clears the user session."""
-    request.session.clear()
-    return RedirectResponse(url='/')
-
-@app.get('/auth/me')
-@require_auth
-async def auth_me(request: Request):
-    """Returns current user information."""
-    return JSONResponse(request.session.get('user'))
-
 @app.get('/admin')
 @require_auth
 async def admin_panel(request: Request):