Engineer login

Sign in shell

This is the placeholder for the dedicated engineer login. The next auth PR should wire this to an engineer-only session cookie, separate from the admin app session.

Planned login rule

Allow ENGINEER and SUPER_ADMIN. Reject admin dashboard roles unless explicitly allowed for engineer testing.