Staff accounts with scoped permissions

Staff accounts now exist alongside the super admin, and they start with no access.

• A super admin chooses which brands a staff member may act on.
• Create, read, update and delete are granted per resource.
• Temporary passwords are shown once and must be changed at first sign-in.
• Disabling an account ends its sessions immediately.