Account access
Sign in once, then move between the dashboard, Theme Forge, and future builders without passing tokens through frontend JavaScript.
Secure by default
The backend owns the session with HttpOnly cookies. The frontend only asks `/auth/me` who is signed in.