Authentication is now linked to `user_account`, role assignments, account status rules, failed login tracking, and password-change enforcement.
The private area enforces active account status, role assignment windows, secure sessions, audit-aware login events, and forced password updates when required.
Login, logout, password policy, account status checks, failed login locking, and MFA-ready routing.
Role-aware dashboards plus course, attendance, content, exam, ticket, messaging, and notification shells.