Restricted operator access

Operator sign-in.

The console opens only after the operator password and a second email code both succeed.

Two gates. Short session. Full audit.

Operator APIs and pages respond only on the dedicated admin host.

A password alone cannot create an operator session.

Repeated failures are throttled and recorded without exposing credentials.

Admin cookies stay host-only and expire sooner than customer sessions.