Serendib Sparks Admin

Google sign-in only. The Firebase admin claim is enforced.

The server session uses a secure httpOnly cookie; Firebase Auth is retained only for this browser tab.