Secure access stays inside the live workspace.

Access now starts with standard Firebase browser sign-in on the front end. After Google succeeds, Cloud Run verifies the token, checks the workspace allowlist, and issues the session cookie for the protected workspace.