Staff sign in

Supabase Auth (@supabase/ssr cookies) + staff allow-list. Locally, an allow-listed email is enough when Auth env is unset (no owner WhatsApp).