Direct auth
No email loops. Username and password, hashed on the server. Super-admin creates privileged accounts.
Accounts, roles, one API
A quiet door into the product.
Sign in with a username. Seven roles on a single ladder. The same JSON API will serve the web UI and later native apps.
Role ladder
Guest, user, moderator, pro, super-pro, admin, super-admin. Middleware checks the rung, not the client.
Plug-and-build
Add a line to the route table and a function next to it. HTML pages talk to /api/v1 only.