Only Mike and Erin should ever use this. After both accounts exist, turn off public sign-ups in the Supabase dashboard — see the README.
After signing in you'll be asked to set up an authenticator app (TOTP) if you haven't already — required for every sign-in, per the security plan.