Admin access is protected by Supabase Auth and row-level security.