Overview

Operator console. Every action is capability-gated and audited server-side; dangerous writes require fresh step-up auth and a reason.