punch-card-api admin

Session cookie is HttpOnly + Secure + SameSite=Strict; 8-hour TTL.