Secure entry
Email/password auth is wired for Cognito and falls back to seeded preview accounts when local credentials are not configured.
Protected entry is wired for Cognito, with seeded local preview accounts when credentials are not configured.
The app opens the correct role workspace after authentication and respects multi-role account selection.