Self-hosting

1. Deploy the CDK stack: auritus deploy
2. Optional: put your Google OAuth client id/secret into the stack's Secrets Manager secret and attach Google as a Cognito IdP (not required for CLI login).
3. auritus login --username you@example.com (Cognito email and password; JWTs cached under ~/.auritus/credentials; see the security page for refresh-token rotation and unattended worker auth)
4. auritus site create --origin https://your.site
5. Run auritus worker on hardware you control so it wins the race against the 15-minute Batch fallback.

Spend guardrails: AWS Budgets disables the Batch queue at the daily threshold; per-site quotas apply; auritus killswitch disable is the manual stop.