Admin sign in

Internal access is gated by Supabase Auth plus app-role checks.

A valid session is not enough on its own. The admin surface also requires the app profile role to be support or admin.