The brain of the platform. Authenticates every request, enforces plan-tier gates, applies rate limiting, and routes traffic to the right domain handler. Every business rule lives here. Authentication is dual-mode through one entry point — a human JWT or a machine API key both resolve to the same org context — and every request runs inside a tenant-isolation envelope a Prisma extension enforces, so a query physically cannot return another organization's data. Human sign-ins are server-tracked sessions with enterprise session hygiene: 15-minute access tokens silently renewed while the user is active (refresh credential in an httpOnly cookie scoped to the one renewal endpoint), a 60-minute sliding idle timeout enforced server-side, a 7-day absolute cap, and instant server-side revocation on sign-out — with idle expiries recorded in the audit trail. Every account also records privacy-policy consent — the version accepted and when — captured at sign-up and re-confirmed if the policy materially changes; the policy text renders from a single source file, so the sign-in consent step, the acceptance prompt, and the public /privacy page can never drift.