Staff sign-in

Temporary passcode login for the org dashboard surface, while real staff auth is built.

This is a stopgap for staging/demo access only — it must never be the only thing standing between the internet and real donor or payment data.