Secure staff access

Welcome back

There is no public signup. Accounts and SSO identities are provisioned only from the backend terminal.

Account provisioning
Run npm run seed:admin with a role, optional scope and expiry, and the administrator's OIDC issuer/subject.