Admin console

Internal staff tools. Every action is access-controlled (RBAC + 2FA + IP allowlist) and audited.