Set FRONTEND_PASSWORD in .env.local to arm the gate. The passphrase is verified server-side; the admin token never reaches the browser.