Admin login

Session cookie via core-api BFF. HMAC secrets stay server-side.