Static HTML loads for anyone, but the /api/whoami data route is
verified at the edge against a signed JWT minted by the intranet issuer.
No cookie — the token rides in Authorization: Bearer.
(no call yet)
Deployed via EdgeOne Makers · protected by eo-makers-auth (edge JWT verify)