Account access
Customer routes, staff tools, and role-protected admin pages all use the same Supabase session and profile role checks.