Epic: Account-first onboarding (no dashboard without an account)

A stranger must sign up / log in before seeing anything; an account owns projects; each project's Settings carries the script tag + DSN. The DynamoDB model (USER# + EMAIL# GSI, sessions, memberships, ownerId, plans) already exists — this epic is the missing flow + enforcement.

Tracks (4):

• #113 — Auth pages: signup + forgot/reset views, cross-linked with login
• #114 — default-on auth enforcement + close the /api/sites open fallback
• #115 — SPA session gate + signed-in identity in the header
• #116 — session cookies across the dev origin split (credentials + CORS)

Done when: bun run dev + bun run dev:server from a clean table → /dashboard redirects to /login → sign up → empty project hub → create project → Settings shows script tag + DSN.

All four tracks shipped + a 17-agent adversarial review hardened the result (10 findings fixed in e76faf9).

• #113 signup + forgot/reset pages, cross-linked with login
• #114 enforcement on by default; /api/sites + stealth aliases require a session; open all-sites fallback closed
• #115 SPA session gate (no dashboard without an account), signed-in identity in the header, account settings page
• #116 same-origin API proxy in the dev server so session cookies just work

Done-when verified headless end to end: a stranger hitting /dashboard is bounced to /login, signs up, lands in an empty project hub, creates a project, and Settings shows the script tag + DSN. Review follow-up (credentialed cross-origin CORS for split-domain prod) filed separately; it doesn't affect same-origin installs.