Sign in to manage the first drop.

Credentials are checked against the single env-seeded admin account. Sessions use a signed NextAuth JWT cookie until W2.2 adds route middleware around the admin shell.