Gateway-backed admin authentication with session cookies scoped to the backoffice.

Email OTP keeps the current sign-in flow aligned with the Go auth service and gateway.

Only accounts with admin roles can establish a backoffice session.