Who gets in

Roles are stored per user, checked server-side on every call, and never inferred from the browser. Allowlisted emails claim admin on first sign-in, so a new owner or manager does not need us to let them in.