Built as a single-file starter. Replace demo secrets before production.