Editorial access

Owner-only panel. The PIN is verified on the server against a stored hash; attempts are rate limited; a short-lived httpOnly session cookie protects every editorial API route. No approval state lives in client code.

If this server has no editorial configuration, unlocking is refused (503). Generate a hash with npm run editorial:hash and set EDITORIAL_PIN_HASH and EDITORIAL_SESSION_SECRET server-side.