Authentication

Staff sign-in

Final implementation should use Google Sign-In with allowlisted staff accounts and a backend session. The browser token flow in the current middleware is only a temporary bootstrap path.