Protection model
Simple, internal-tool friendly access control
- Shared passwords checked only on the server
- HttpOnly signed session cookie after login
- Middleware protection for app pages and API routes
- Server-enforced write lock for read-only sessions
- Task and resource changes stamped with the signed-in display name
