It's worth remembering that users don't care what version of Webpack or Rollup you're using. They just care if the app works and it's fast. Devs love to sprint to embrace some new tool that's supposedly going to make their own life easier (TypeScript, hot reloading, linters, faster build times, whatever). This kind of stuff has approximately zero impact on the user experience, though. And arguments that dev experience trickles down to user experience are largely wrong. https://infrequently.org/2018/09/the-developer-experience-bait-and-switch/
yesss thanks to this article from @aaronpk I managed to set up a little server that lets me put any service I want behind Mastodon's OAuth so that only people with a friend.camp login can see it. It works for web apps that don't know what OAuth is -- you are just kind of "gating" them so that any request to any URL for the app must be authorized first. A little like .htpasswd but for OAuth.
https://developer.okta.com/blog/2018/08/28/nginx-auth-request
I'll write this up in detail later but Aaron's post has everything you need.