Admin sign in

Operator access only — not for customer onboarding.

Customer sign-in uses mobile OTP at /auth.