Requires the admin role (set server-side via app_metadata.role = "admin") or a verified @nextrare.cards email. Any other valid sign-in is rejected by the portal.