Protected demo build. Client-ready access gate —
swap in real server auth before handling live client data.