This application will serve coach-branded B2C flows on `*.praximo.me`.
Current host: client.localhost
The first protected boundary is `/portal`, wired through the local Better Auth instance.