Admins sign in with Supabase Auth. Writing needs both a server-side secret key and an address listed in ADMIN_EMAILS — signing in alone grants no more than the app already reads.