Read this before you plan anything that assumes stored data — "cache the resource", "resume the session", "show the user's past reports". This app has no persistence layer at all. Every byte lives in the backend process, and dies with it.
Not "not yet configured" — nowhere in or is there an ORM, a driver, or a browser store. The tokens in this note's frontmatter (, , , ) are re-grepped on every check, so this claim cannot silently go stale: the day one of them appears, the gate fails and this note is wrong on purpose. Nothing is written to disk, no user is identified, and no state survives a process restart — which is also why finds no auth chokepoint to guard.