- Shell requires a session (oauth2-proxy), with sign-in and sign-out
- Project switcher; first-VDC screen when a project has no VDC yet
- Core calls route through /vdcs/<id>/core/* for the active VDC
- Tenants manage their own VDCs, members and Cloudflare account
under Data Centers; the cloud admin area and server groups are removed