Our admin panel answers 404 to every signed-in account that is not on a hardcoded list

Who counts as an operator is a constant in the source, not a column or an env var. Thirteen call sites re-check it, and the refusal is a 404.