SPA credential flow + backend /api/* auth lockdown, plus wizard/UX co-pilot work and outstanding planning items.