Secret link / token gate. APIs under /api/** stay open for local curl.
/api/**
Default token is nordic-demo (override PAYEVIDENCE_DEMO_TOKEN).
Or open /demo?token=nordic-demo once to set the cookie.
/demo?token=nordic-demo