Navigator-Autopilot

App area is now live. Next step: connect SSO + roles once the IDP is repaired.

Next milestones

Create /login route (button on landing page)
Create /auth/callback route (OIDC redirect landing)
Add protected layout + “signed-in user” placeholder
Wire to UBuild360 IDP once stable