Admin access is cookie-backed and workspace-scoped.

Use the seeded default admin credentials from the API environment, or create your own admin user through the backend service layer.