API: — read views + owner-gated write forms. Token lives in sessionStorage only (tab close = gone). Identities are hashes only. Deny stores its reason server-side; other writes are audited (who/when/what) — full reason storage for them needs the T29 audit reason-column migration. Code issue displays the just-issued code (the admin forwards it); the bulk issued-codes list is NOT included (phase 2 decision). NOT live-tested: staging deploy + real login test still needed.