Authentication
Google login is the only entrypoint. The app verifies the ID token server-side and creates its own secure session cookie.