Staff login

Shared-passcode gate, set by ADMIN_PASSCODE. Replace with real staff accounts before launch.