Demo mode — every sign-in resolves to the shared demo therapist. Set the server-side FIREBASE_* env vars and remove AUTH_BYPASS for real per-user accounts. Check auth status.