Sample persona content removed. Owner-safe projections via CASA_API.memberapp. No direct protected reads; auth tokens never stored in localStorage.

Activation is exactly-once per application. Member numbers are reserved uniquely and never used as document IDs. ID cards are vault-encrypted with opaque QR tokens — owner authenticated stream only; no public URLs. Missing number format or template blocks activation.