Operations
Admin access
Reading Progenitor needs no account. Acknowledging a signal writes to the research database, so it needs the shared admin token.
One shared token, one signed cookie, one guarded action — enough to keep the database read-only for the public. Per-user accounts and roles are a later task.