New Features & Additions
- Account registration with display name, username, email, and password.
- Login with cookie-backed demo sessions (7-day expiry).
- Logout with server-side session invalidation.
- Role-based route protection: admin areas restricted to administrator accounts.
- Security center page with event log and account-level recommendations.
Bug Fixes
- Session token is now HttpOnly, preventing client-side JavaScript access.
Known Issues
- Email verification is scaffolded but mail delivery is not yet connected.