Staff sign-in with email and password. After login the browser keeps only an httpOnly cha_session cookie — not a Firebase or API bearer.