Tokens are issued via node scripts/issue-admin-token.js --sub <email>
and verified against the ADMIN_SECRET binding on the
kilc-guardian Cloudflare Pages project.
If you've lost your token, revoke any active session via
wrangler kv:key put GS_REVOKED_JTIS <jti> 1
and issue a new master token.