Protected operator access
A single shared password is enough for this internal tool, but it still lives in environment-backed configuration so the repository never becomes the secret store.