Revoca Admin

Operator console for IAM, roles, and project visibility. Protected by ADMIN_PASSWORD.