Secure access
Sessions are handled with Supabase SSR cookies so protected routes stay in sync between the marketing site and your operator console.