Authentication runs at the reverse-proxy layer (HTTP Basic). The Settings surface here will own:
- Session / sign-out
- Theme preference (currently lives in the header toggle)
- Default surface on login (per-persona landing — brief §2.4)
- Saved searches (Epic 13 schema; FE-041 UI consumption)
- Notification preferences (deferred — Phase 2)