Console traffic

The console is the supported public management entry point. Its authenticated proxy routes browser and approved-client requests to fleet-site services without exposing those controller services directly.

Authentication and authorization are applied before management requests reach their upstream services. Enrollment uses separate bearer-controlled bootstrap material and is not an anonymous management API.

Keep console and API access on the reviewed private management path. Do not publish a direct controller port, copy session material into examples, or forge identity metadata.