Operator sign-in

This is the bounded operator UI gate for the control plane. The backend API remains separately protected behind the control-plane boundary.