Host sign in

Protected entry for venue staff and d8zero operators.

Auth wiring starts after the v2 data and access-control baseline.