Staff sign-in (Gate 1 placeholder).

Real auth (Firebase) arrives in Phase 3. This gate checks a staff email allowlist.