Admin sign in

Single-admin access. Credentials live in .env.local.