Server-side RBAC with default-deny. Hash-chained audit trail. Hardened approval state machine. PostgreSQL system of record.
Development authentication stub. Identity only — roles come from PostgreSQL RBAC.
Quick stub sign-in (password autofilled)