Public Access
- backend/app/security.py: require_session() now auto-authenticates by returning the first family_profile_id from the DB. No cookie or password needed. Falls back to "bootstrap" sentinel if no FamilyProfile exists. Admin routes (require_admin) still protected by bearer token. - frontend/src/api/index.ts: removed 401→/login redirect interceptor - frontend/src/App.tsx: removed Sign out button, removed /login route and Login page import - Login page kept on disk (unused) for potential future re-enablement