WAN Access Boundary

LARA stays locked until authentication succeeds.

This public page is the only WAN-visible surface before sign-in. The protected React application, operator workbench, ALICE task tools, and browser bundles are served only after an allowlisted Google account establishes a valid session.

• Public root only serves this login shell.
• Protected application entry lives behind session verification at /app/.
• JavaScript and CSS bundles are not served to unauthenticated requests.