Use Discord OAuth for the strongest admin access control. Password fallback can be disabled with WEB_AUTH_MODE=discord.