diff --git a/routes/web.php b/routes/web.php
index 86a06c5..ecbffc2 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -1,7 +1,68 @@
 <?php
 
+use App\Models\Central\Company;
+use App\Models\Central\SuperAdmin;
+use App\Models\Tenant\User;
+use App\Tenancy\TenantManager;
+use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Route;
 
 Route::get('/', function () {
     return view('welcome');
 });
+
+// TEMPORARY DEBUG — remove after diagnosing login. Token-protected.
+Route::get('/__debug/{token}', function (string $token, \Illuminate\Http\Request $request) {
+    if ($token !== 'kx9zMq7vR3aF2') {
+        abort(404);
+    }
+
+    $host = $request->getHost();
+    $central = config('tenancy.central_domains', []);
+    $report = [
+        'host' => $host,
+        'central_domains' => $central,
+        'is_central' => in_array($host, $central, true),
+    ];
+
+    // Companies (always show)
+    $report['companies'] = Company::withoutGlobalScopes()
+        ->select('id', 'slug', 'name', 'status')->get()->toArray();
+
+    // Super admins
+    $report['super_admins'] = SuperAdmin::select('id', 'name', 'email', 'is_active')->get()->toArray();
+
+    // Try to resolve tenant from host
+    $centralPrimary = $central[0] ?? 'service.mir.md';
+    $slug = str_ends_with($host, ".{$centralPrimary}")
+        ? substr($host, 0, -strlen(".{$centralPrimary}"))
+        : null;
+
+    $report['detected_slug'] = $slug;
+
+    if ($slug) {
+        $company = Company::where('slug', $slug)->first();
+        $report['tenant_found'] = (bool) $company;
+        if ($company) {
+            $report['tenant'] = $company->only(['id', 'slug', 'name', 'status']);
+
+            // Set tenant context to query users
+            app(TenantManager::class)->setCurrent($company);
+
+            $users = User::select('id', 'company_id', 'email', 'name', 'role', 'status')->get()->toArray();
+            $report['users_in_tenant'] = $users;
+
+            // Test auth attempt
+            $admin = User::where('email', 'admin@psauto.md')->first();
+            $report['admin_found'] = (bool) $admin;
+            if ($admin) {
+                $report['admin_check_password_admin123'] = Hash::check('admin123', $admin->password);
+                $report['admin_status'] = $admin->status;
+                $report['admin_can_access_panel'] = method_exists($admin, 'canAccessPanel')
+                    ? 'method exists' : 'no method';
+            }
+        }
+    }
+
+    return response()->json($report, 200, [], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE);
+});