Demo build — simulates Microsoft Entra single sign-on.In production: Entra ID (OIDC), MDM-managed, no local passwords.