Admin sign-in
Admins are @expensemap.com Google accounts (plus ADMIN_EMAILS and the manual admin token). The server enforces this on every admin API — signing in here never grants access by itself.
Use a Bearer token instead
Paste a JWT (for example the manual admin token from cmd/generate_admin_token). Stored only in this browser's local storage.