Worker still refuses to import backend.main. Auth router is mounted unchanged; CORS stays outermost so 401s keep headers.