Shouldable admin access

Design review is now part of the app.

Use the shared admin password to access the review workspace, survey management pages, prototypes, and research tools.

Design review

Shared comments, regeneration requests, and review state now live alongside the rest of the app.

Secure session

Password verifies on the server; the browser only stores a signed, httpOnly cookie (not a shared static value).

Enter password

Configure ADMIN_PASSWORD and optionally a separate ADMIN_SESSION_SECRET for HMAC signing (recommended in production).