split backend framework into separate repo & include w/ composer.
ignore composer binary. detect update/install in make deps.
protect routes w/ controller auth plugin.
split out cli bootstrapping.
move bootstrapping from docroot index into bootstrap.