What requires login
Authenticated admin users can access contacts CRUD, R2 image library/object APIs, Send Email, and R2-backed Save/Delete for named documents.
Admin auth uses signed cookie sessions with comma-separated ADMIN_USERNAME and ADMIN_PASSWORD pairs.