Authenticate before operator work.

This UI stores the JWT in browser local storage for internal MVP sessions only. Production rollout should move to httpOnly cookies or a dedicated session layer.