Building the flagship (1): browser-correct cookie auth in Fitz

The Admin panel's auth, in full — why it's cookie-based and not Bearer, an Argon2id + JWT login that Sets a HttpOnly cookie, and protected pages that resolve the user via the ORM and redirect to /login. Plus the responsive shell.