Operator sign-in

Restricted area — access is limited to the platform staff allowlist, and 2FA is required.