Internal sign-in

Choose a demo role

Development session with server-side permission checks. Production auth will replace this flow.