Organization sign-in

Phase 7A enrollment-only service. Admin access requires a secure password. MFA is required before any future sensitive media or remote-workflow features.