Phase 1

Sign in to Adminweb

This admin surface runs through a server-side BFF. Browser requests never call protected backend /admin/* routes directly.