Classic Firebase Hosting serving a static page. Public Auth0 client (Authorization Code + PKCE), tokens held in browser memory only — no server-side session anywhere in this demo.