Users are created by a Supabase admin (signup disabled). After sign-in you will complete 2FA. Dashboard is protected by middleware + 2FA + RLS.