Demo only: placeholder password check. Replace with real auth (e.g. Cloudflare Access) before production.