The lease endpoint requires a Supabase Auth session. For the June-5 demo the middleware mints a demo session automatically, but it didn't fire on this request — the most common cause is missing env vars on the runner. Check DOMNIA_DEMO_MODE=1, SUPABASE_JWT_SECRET, and SUPABASE_SERVICE_ROLE_KEY. VOR-021 (real sign-in flow) tracks the production replacement for this path.