Access / Route Gate
Validating operator session
Protected surfaces stay hidden until the local auth state resolves.
policy
private routes only
fallback
/login