CantWait Admin

Sign in as app admin.

Login uses Supabase credentials or a direct Supabase access token, then verifies `app-admin` access against backend admin endpoints.

Required for access: backend user must include access group app-admin in JWT claims.