Public entry routes stay portal-owned and reuse the same browser shell family.
Canonical local web login entry owned by `portal_app`.
This route remains the single browser login entry for the unified local origin.