Moderator sign-in

Accounts are created from the server shell with npm run create-mod. There is no sign-up, no password reset, and no email flow — deliberately.