Admin access is server-protected, RLS is mandatory, and screenshots stay private. TODO: expand after Supabase setup.