Secure staff access is live.
Local auth, sessions, roles, and per-user permission overrides are active in this build. MFA is available for staff who want the extra checkpoint, but it is not required for normal console access.
Local auth
Role + permission model
Session-backed access
Optional MFA
Staff sign-in
Seed credentials can still bootstrap access through npm run db:seed, but users flagged for rotation are now forced through an in-app password reset before they can reach the console.