Authenticate to enter the single-store production dashboard.

Credentials are exchanged server-side; access and refresh tokens are kept in HttpOnly cookies.