Ghost staff authentication is part of the public-site attack surface

A review of Ghost staff login security, reset behavior, and public deployment inventory.