Phase 4 admin shell. Backend auth will enforce roles before these controls are connected to live data.