Operator-only — refunds, reschedules, customer records.
Leave email blank to use the legacy admin password (break-glass).