TruepixID app ✅

served via CloudFront → OAC → private S3