Canonical portal-owned shell family for unified browser routes.
Admin read access requires a valid role-scoped session.