Secure access portal

Authenticate to reach the Hermes dashboard. Failed attempts are rate-limited and sessions are signed.

Security headers, HttpOnly SameSite cookies, lockouts, and localhost-only upstream proxying are enabled.