PLATFORM ACCESS
Sign in belongs behind the public-site boundary.
This route establishes the public-to-authenticated transition. Production authentication, tenant resolution, role resolution, and authorization will connect here when the platform identity service is deployed.
Authentication boundary — intentionally not simulated
No production identity provider is connected in WEB-01 BUILD 03. This prevents the public website from presenting fake credentials or an insecure placeholder login as if it were operational authentication.