Staff and security

Setup → Staff lists accounts. Invite by email; new staff set a password from the link.

Roles map to permissions checked on routes and hidden in the UI. Packers focus on orders; staff may edit catalog or content when allowed.

Admins may enroll TOTP; recovery codes are shown once. Session timeout and re-auth protect payment keys and sensitive exports.

Failed logins are rate-limited with temporary lockout.