Restricted / Server-authorized
Magic-link authentication is restricted to addresses configured in ADMIN_EMAILS and verified again against app_admins.