Local-only read-only Web MVP with Cookie Authentication. Write operations, uploads, signed file URLs, and user management are not implemented.