Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@docs/superpowers/specs/2026-03-14-homepage-design.md`:
- Around line 133-151: Update the spec to reflect the implemented routing:
instead of mandating a HomeOrRedirect component outside PrivateRoute that
redirects authenticated users from "/", document that the app currently renders
the homepage at "/" for both authenticated and unauthenticated users and adjusts
CTA state based on auth (useOptionalAuth / fetchMeOptional-driven UI
adaptation), and update the latency mitigation note to explain that
fetchMeOptional is used to avoid forced redirects and to allow the homepage to
render while auth state resolves (mention useOptionalAuth, fetchMeOptional,
PrivateRoute, and the CTA behavior on HomePage/LoadingSpinner/Navigate where
relevant).

In `@packages/frontend/src/app/home-or-redirect.tsx`:
- Around line 16-27: The homepage computes workspacePath too early while the
useQuery for workspaces (queryFn: fetchWorkspaces) is still unresolved, causing
a temporary null that can trigger a login CTA for an authenticated user; update
the logic that derives workspacePath (the const workspacePath) to only decide
between a real path or an explicit “no workspace” value after the workspaces
query has finished (use the query's isLoading or isFetching flag returned by
useQuery or check workspaces !== undefined) so that when user is truthy and
workspaces are still loading you neither return null nor show the login CTA;
reference useQuery, fetchWorkspaces, userLoading, Loader, and workspacePath when
making the change.

In `@packages/frontend/src/app/home/demo-section.tsx`:
- Line 4: Replace the hardcoded DEMO_TOKEN constant by reading it from an
environment variable (e.g., process.env.NEXT_PUBLIC_DEMO_TOKEN or
import.meta.env.VITE_DEMO_TOKEN depending on build system) inside the
demo-section module; update references to use the new token variable and add a
fail-fast check during module initialization or component mount that throws or
logs a clear error and prevents rendering when the env var is missing/empty so
token rotation and secret management are possible. Ensure the symbol DEMO_TOKEN
is removed and replaced consistently where used in demo-section.tsx and validate
the env var presence early.

In `@packages/frontend/src/app/home/footer.tsx`:
- Around line 15-17: The "Docs" and "API" anchor elements in
packages/frontend/src/app/home/footer.tsx (the <a> elements with innerText
"Docs" and "API") currently point to the same GitHub URL; update their href
attributes to the correct documentation and API reference URLs (or add a clear
TODO comment next to those <a> elements indicating the correct links to be
added) so they no longer duplicate the "GitHub" link (you can locate them by
searching for the anchors with className containing "hidden md:inline
text-stone-400" and innerText "Docs" and "API").

In `@packages/frontend/src/components/theme-provider.tsx`:
- Around line 36-45: The externallyControlled flag (created via useState in
ThemeProvider) is computed once from window.location.search and never updates,
causing URL-sourced themes to block future localStorage writes; fix by tracking
the source of theme changes instead: introduce a small source enum/state (e.g.,
'user' | 'external') or a boolean like isUserInitiated and update setThemeState
to accept/record the source, call setThemeState(..., 'external') when applying
theme from URL/postMessage and setThemeState(..., 'user') from UI interactions,
and only write to localStorage (using storageKey) when the source is 'user' so
user toggles persist while URL/postMessage origins do not prevent future
persistence.

---

Nitpick comments:
In `@packages/frontend/src/app/home/developer-section.tsx`:
- Around line 118-132: highlightCode currently re-tokenizes static strings on
every render; compute the highlighted JSX once and reuse it by either calling
highlightCode(restApiCode) and highlightCode(cliCode) at module scope (e.g.
highlightedRestApi / highlightedCli constants) or by wrapping those calls in
useMemo inside the component (depend on []), then render those memoized values
instead of calling highlightCode directly; reference highlightCode, restApiCode
and cliCode to locate and replace the repeated calls.

In `@packages/frontend/src/app/home/features-section.tsx`:
- Around line 44-49: The map callback currently uses a short, non-descriptive
parameter `f` in the features list renderer; rename it to `feature` in the
`features.map(...)` callback and update all uses inside the returned JSX (e.g.,
`key={feature.title}`, `{feature.icon}`, `{feature.title}`,
`{feature.description}`) so the code reads clearly and follows naming guidelines
while preserving existing behavior.

In `@packages/frontend/src/app/home/opensource-section.tsx`:
- Around line 16-22: The map callback in badges.map currently uses a
non-descriptive variable name `b`; update the callback to use a descriptive name
(e.g., `badge`) in the badges.map call and inside the JSX span (the element
rendering the badge) so the purpose is clear—look for the badges.map(...) usage
in the OpenSourceSection/opensource-section component and replace occurrences of
`b` with `badge` (or another clear name) in the key, className usage, and the
rendered content.