Dev Login

Phase 1 uses seeded local accounts only. Full signup/login management is intentionally deferred.

Need active entitlement for Today routes.