Real Layout Lock

Password-gated unlock for shell/nav/routing deploys. Enforced in deploy:vps.