TLS and the reverse proxy are live. The API path /api/* goes to the BFF on loopback.
Not deployed yet: the operating interface (this page is a placeholder) and the identity
layer. Every call to /api/* currently returns 401 by design — no credential is
shipped to the browser, so there is nothing here for a visitor to read.
See synapse-bff/docs/adr/ADR-003-edge-and-identity-zitadel.md.