Single-admin access with short-lived JWT cookies, protected CRUD routes, and D1-backed audit logging.