Sphere admin

Internal use only

First-time setup: use ADMIN_USERNAME (default admin) and ADMIN_PASSWORD from env once; your password is stored as bcrypt. Add more accounts under Staff after login.