Authentication is backed by Amazon Cognito (see docs/implementation-plans/phase-6-implementation-plan.md section 6.5); a dev-only fallback authenticator is used when Cognito is not configured.