Private owner area

This gate protects owner-only routes. Private app content is not rendered until the owner session is valid.

Production access requires a configured owner token. The session cookie is HttpOnly and scoped to `/app`.