Admin panel — staff access only

Admin accounts require 2FA. Point API_BASE_URL in api.js at your deployed backend before this works.