Portal sign-in itself is enforced by Cloudflare Access (named person, one-time PIN).
A person needs BOTH an Access policy entry (Cloudflare side) and a row here (application side).
Until the UES shareholder representative is designated, the hub is internal only (PL-003).
