Admin demo — the passphrase gate is client-side only. Never ship this without real auth.