Stateless auth, RLS-scoped clients, and CORS on the server, without the boilerplate.