V1 internal back office. Use ADMIN_SECRET from your .env (not student magic-link login). With DEV_AUTH=true only, you can skip the secret locally.