Control Panel
Secured by JWT + refresh token rotation. Sessions survive restarts via HTTP-only cookie.