Admin sign in

Paste the ADMIN_TOKEN from Vercel env. The token is exchanged for an HttpOnly session cookie scoped to /admin.