Secure access for coaches, participants, and administrators with module-level permissions.
Local demo mode is active until Cognito env vars are configured.