Access and refresh tokens are requested from the Django backend and persisted by the frontend session helper.

Dashboard route is protected by middleware checking a lightweight auth cookie.