Feature Request: docs or advice for private, not just self-hosted, deployment

### Description

General guidance on ways to use or adapt the deployed solution such that the frontend and backend are __private__, not just self-hosted.

Or, if truly private view/publish/pull of constructs is already supported, more detail around exactly how authN/authZ works?

### Use Case

I'd like to a private, self-hosted deployment of Construct Hub in a dedicated shared-services account and everything (read/write/update/publish for frontend, backend) gated by AWS SSO (Identity Center app, maybe?) or - at a minimum - only via VPC access.

If access was VPC-only, we could then use (for example) AWS Client VPN as a gate.

### Other information

_No response_