The website now ships as apps/web in the existing monorepo, with a shared design system in packages/ui. That is deliberate: the game framework, the API and the website read from the same contracts and the same records, and a website with its own database would be a second source of truth from day one.
What is real today: the public site, the rules, the roadmap, and a portal that can list characters and create pending characters through the existing backend contract. Character creation is validated against the backend’s own name schema, and the request carries an idempotency key so a double submission cannot create two characters.
What is not real today, and is labelled as such in the interface: registration, sign-in, password reset, application tracking, notifications and account activity have no backend endpoints yet. Rather than fake them with hardcoded success screens, the website documents the missing contracts and fails honestly when they are unavailable.
Session handling is intentionally conservative. The opaque session token lives in an httpOnly cookie, is never written to localStorage, and is never rendered into the page. Route protection in the website is a usability measure only — authorization is decided by the backend on every request.