Admin access is protected by session or signed cookie authentication.
Use env-backed credentials only. No secrets are hard-coded.
Simple RBAC foundation for the localhost prototype.
ADMIN_PASSWORD or ADMIN_TOKEN required. Optional: OPERATOR_PASSWORD, VIEWER_PASSWORD, SESSION_SECRET.