Protected operations

Sign in before touching supplier, payment, and booking controls.

This keeps the admin cockpit ready for live OCTO credentials without exposing operational controls to public visitors.

Signed session

HTTP-only cookie with expiry.

Server guarded

Pages and actions verify access.

Local ready

Development stays easy.