Auth boundary

Sign in, then choose the fleet workspace you can access.

Workspace context is resolved after credentials are verified, so tenant and company identifiers stay out of the sign-in form.