Member operations require a trusted session.

Authentication is handled by Supabase. Database access is additionally checked against the active admin roster and protected by row-level security.