Admin sign-in

Bearer token only for now — kept in memory for this tab, never stored (TECH_STACK.md §5).