What it covers

The rail groups the screens as below. Each screen is shown only to the roles that can use it, and a module's screen only when GET /api/modules reports that module running.

Group	Screens
Main	Overview (stats, latest entries, health summary, command palette). Entries (create, edit, publish, archive, filter, version history with rollback). Content types (opening one opens its entries, fields are a second link; cards or list, search, sort). Pages (the page tree: drag or move pages, the navigation flag, slugs, redirects after a move). Workflows (trigger builder, conditions, actions the API registers, dry run). Queries (saved fetches a workflow can use)
Site	Site (tenant name, logo, header and footer links, site mode, holding page, share links). Theme (colour slots, fonts, radii, widths, tokens and tones, with a contrast check). Style recipes
Access	Tenants and their domains. Users. Roles with a per-content-type permission matrix. Groups and members. API keys, with scopes, optionally limited to content types
Modules	Accounting, Analytics, Email events, Feature flags, Files (uploads in the background, image preview and viewer), PWA installs
System	Audit log, Errors, Workflow runs, Health, Email, Security (two-factor), Devices, Export and import, Import a spreadsheet, Connectors, Outbound requests, Settings

Sessions ride the API's rotating refresh tokens: the 15-minute access token renews automatically, and a single in-flight refresh is shared across concurrent requests so the backend's replay detection is never tripped. The access token lives in memory, not in local storage.