App Mapping and Credential Config control.

Store keys are isolated in server-side Vault.

Console access is enforced by Supabase Auth and Prisma RBAC.