Private gated planning module

Real access control before real defensive planning tools.

The public simulator stays shareable. BDA moves here, behind account approval, server-side authorization, and private project storage.