Password-protected page demo

• Protected areas: /kb, /ref
• Set BASIC_AUTH_USER & BASIC_AUTH_PASSWORD env vars to control access.
• Current demo still uses Basic Auth via edge middleware.