Single-team auth
Protected Next.js shell, typed FastAPI backend, no exposed AA→NT app bundle before login.
This app uses the minimal signed-cookie pattern you liked in the Modal app, but moved into the Next layer so both the page and the same-origin backend proxy stay gated.