Sign-in (Google OAuth + Turnstile) lands in the next build phase. This is a placeholder shell.