What the auth routes need.
Readonly
Boot-time portal runtime (source of pinned host/port/secret).
Shared config store providing the live config per request.
The portal's runtime stores, the same bag its start sweep uses.
What the auth routes need.