Admin console

Admin console: internal, use the SSM tunnel.

Staff open an AWS SSM port-forwarding session to the control-plane host (remote port 9542), then browse to http://127.0.0.1:9542/admin/.