Workspace access
Auth via backend API; session is stored in the browser for protected screens.
No demo passwords or fake success in the UI.
Accounts stay behind login.