Authenticate through body-auth

This internal app does not validate workforce identity directly. It expects a `body-auth` CRM-admin session and bootstrap, then renders only thin `body-crm` operator data.