Compliance-first access

Protected admin access for regulated teams.

Invite-only registration, verified identities, server-side sessions, and audit visibility by default.