I really appreciate that you took the time to clarify this. I was surprised by parents comment about needing auth twice but they seemed confident. Honestly worried I have apps with auth gaps!
But what you wrote matches my understanding. I have some routes that are pure LiveView and some that go through controller routes with HTML, and it was clear to me where I needed auth when I made them.
Reminds me of when Android phones used to do the same with analog audio jacks.