This console is gated in-app via SSO (Google/Firebase Auth) with the admin API behind IAP.
MOCK-ERA GATE — navigation UX only, nothing is authenticated. The real SSO wire lands at Phase E; IAP protects the admin API at E.S.7. Loading this public shell is not a breach, by design (M-3/CON-12).