The Operator Lite route remains a launch surface and not a protected app mount.
Portal-owned launch surface for the unified local web origin.
This route remains the controlled handoff point for Operator Lite access. The deeper app session bridge stays deferred until the portal-owned web boundary remains authoritative.
/login./portal.Safety rule: no second web auth plane is introduced here, and no direct auth merge is performed in this step.