Staff sign in

Placeholder. Magic-link sign-in against the staff allowlist, then the device-approval check, land here.

clinic-login-root