Auth, admin and audit — already wired up.

• Google OAuth and email sign-in out of the box
• Database-backed sessions you can revoke per device
• Audit logging and admin impersonation built in