Secure foundation: auth and fail-closed start

Admin only after sign-in, safe startup, data migrations, no demo content in runtime. Local-first, no required cloud.

Added

16 July 2026

Finished

30 August 2026