kovakmedya
1dd8627c30
These DLS module routes were added in the previous bootstrap but the auth middleware's PROTECTED_PREFIXES list still mirrored isletmem's CRM modules, so /jobs/inbound etc. were returning 200 without a session and exposing the placeholder shell. Build smoke test caught it; layout-level redirect alone was not enforcing it for those paths.