Institutional sign-in.

Authenticate once, then resolve directly into the protected workspace route. This public-facing entry surface does not grant access, alter roles, inspect protected records or override workspace assignment.