Email/password or GitHub. App routes stay behind this gate.