Real authentication. No secret handshake.
Use an existing Supabase account with an administrator role assigned through trusted server-side app metadata. There is no public admin registration.
