Staff sign-in only. Accounts are created by NEXTR, not self-serve.
2FA is not wired up yet — required before this ships (project brief §2).