Bearer + httpOnly cookies. bcrypt-hashed. RBAC-scoped.
Patient-facing links (`/patient/onboard/:id`, `/patient/passport/:id`) remain public and do not require sign-in.