Serendib Sparks Admin

Google sign-in only. Admin allowlist enforced server-side.

Session uses secure httpOnly cookies. No admin token is stored in localStorage.