This panel sits above every restaurant and holds none of their data — each restaurant lives in its own sealed database. Access needs an operator login with a six-digit authenticator code, or the SSH tunnel on the server; every sign-in and every restaurant created is written to the audit log.