Access Control

The /private/ section is a separate Docusaurus content-docs instance at a different route (/private vs /docs), which keeps it out of default navigation and out of crawlers that only follow links — but that is not access control. Docusaurus itself has no built-in auth.

Decision: gate knowledge.forestsquad.org/private/* with Cloudflare Access, using Google as the identity provider. Access happens at Cloudflare's edge, in front of Vercel — nothing in this app needs to change for it to work.

The full setup runbook (Cloudflare DNS, Zero Trust, Google OAuth client, the Access policy itself) lives at /DEPLOYMENT.md at the repo root, since it's account/dashboard work rather than application code.

Until that's done: this section is unauthenticated. Don't link to it from anywhere public, and don't deploy it to a hostname that's reachable before the Access policy is live — see next steps item 7.