Internal sign-in

Use a real session, not a hardcoded actor id

/auth/login + /me

This internal shell now signs into the existing Nest auth endpoints and resolves the active operator session on each request.

Account lifecycle

Invitation + reset
  • New staff accounts should arrive through an invitation link and set a password on the activation page.
  • Existing staff can request a password reset if they lose access.
  • Local demo credentials still work only while `PPDT_SEED_DEMO_AUTH` remains enabled on the API.
Accept invitationReset password