Add is_api_gateway_available() helper that checks for API_GATEWAY_URL env var. Before each simulated response (login, MFA, refresh), emit a conditional warn when API Gateway is configured but gRPC not implemented, plus an unconditional SECURITY: prefixed warn making simulation state clearly visible in production logs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>