Cerata Landing/Gate -- Cloudflare Worker is alive.
GET /login -- login page.
GET /reset -- forgot-password / set-new-password page.
GET /galleys, /quarterdeck, /starmap -- role-gated rooms (stub content).
POST /login {email, password} as JSON -- sets a session cookie on success.
GET /whoami -- reads the session cookie, reports who's logged in.
POST /reset-request {email} -- emails a 30-min reset link if the email is on the roster.
POST /reset {token, password} -- sets the new password if the token is valid.
GET/POST/DELETE /admin/users -- Architect-only roster list/add/remove.
Ocean/Vanguard/Nexus content behind the three rooms not built yet.