- /admin login page (public, noindex): password form + signed-in panel that
activates the in-page console. Verified in-browser: login -> panel -> the
astroagent handle appears on other pages.
- Secret-link login: visit /admin/<token> to sign in without a password.
adminauth token() validates a bcrypt-hashed token, sets the session, 302s to
/admin. nginx routes the token path to PHP. set-admin-token.php generates it.
- Password login kept as a fallback.
Verified: token link -> session -> console access; bad token -> /admin?e=1.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DoFYZY9gkGPNDqZ7NuEa9a
Carlos Arias
b967419717