Control room production protected mode requires Firebase Auth and control_room custom claims. No panic queue, GPS context, device health, active shifts, incidents, or dispatch details are visible before sign-in and role verification.